2FA would be a great addition. But I think for security reasons, instant withdrawal should never be possible. I am okay with 5-7% burn for a 2 week powerdown. 1 week is not much time to notice that you have been hacked. What if you are on vacation (usually without your active key in pocket)
Recovering your account is kinda useless, if the STEEM is already gone...