Xero has implemented 2FA a few months ago.
2FA is really good when people re-use their passwords on multiple sites so if one site gets compromised and your password is leaked, 2FA will prevent hackers to log into other sites. In terms of Manager Cloud, the one roadblock is that every customer is hosted on their private domain. So hacker would need to know domain name of your cloud site and your username which doesn’t necessarily need to be your email address.
Xero has the same login page for all customers and they do require usernames to be email addresses. So without 2FA, it was marginally easier to hack into Xero account than into Manager Cloud.
This is not an excuse for Manager not supporting 2FA. It’s just an explanation why it has been prioritized a bit lower than other features. It’s still going to be added, most likely before end of this year.