the only protection is being inconvenienced and building VERY large passwords with mixed characters, and the only way to manage this is with Keepass or Lastpass and with a long passphrase and make sure you don't have malware on your computer such as keyloggers.

Two tier authorization is nice for some apps, but for Google I tried it and it was so onerous that I had to turn it off.