It's 2020, and username and password is well known to be easily circumvented. The process for using Hosted is to log into hosted with username and password, and then open file using username and password. Users will naturally want to make those 2 passwords the same.
We have now added (optional) MFA to Reckon Hosted Logins.
Help documentation is here: https://help.reckon.com/article/w8sdefeh57-mfa-multi-factor-authentication
Two-factor authentication (2FA) should be standard security pratice these days. Reckon is behind the "8" ball when it comes to security. Please implement 2FA ASAP.