Your account already has some protection in that you have to type a code from your email if someone else logs in or if you use a different computer to play. They would have to hack your email or you should never use the same password for this as your email account.
Yeah, that is the best step for securing accounts. I chose email because that is what most everything is linked to. I can understand wanting extra security but it's not really needed with the current two-step verification. You would either have to have some kind of trojan, your email gets hacked or someone would have to try and bruteforce the access code from your email. I'm sure the game has ways to prevent a person from repeatedly entering the wrong codes and would block access from that ip address.I think he just wants to have the added security. As for the never use the same password as your email, it should be never use the same password as anywhere else. I have a completely different password for every thing I log into. On top of that, they are always very strong. Probably why I have never had a game account hacked into. That, and I have never fed the Gold Farmers.