@BlockstreamApp (formerly green wallet) has multisig 2fa feature. if you were using a HWW which turned out to have a hardware bug, using @blockstream wallet (and turn on 2fa eg google auth), you would have a last line of defense: the seed alone does not allow theft of funds.