About 3 and 4:
Passwords are shit. I know it sounds weird, but they’re actually pretty weak, modern computing can do 1 trillion attempts in a second, breaking the most secure passwords in a couple of minutes..Modern 2FA is also not decent enough, as has been proven by simjacking. A FIDO2 device, preferably a NitroKey, due to the fact that it is FOSS, is actually a really good alternative to these and I would recommend buying one if you have the money. Most big services support it (but sadly, not discord.).
Use it everywhere you can.
EDIT: I really hope Flarum supports FIDO2 so we can use it.