Do users have two-factor authentication (2FA) protection?

Yes, draglet supports Google Authenticator and email-based 2FA.