I strongly recommend implementing standard TOTP-based Two Factor Authentication, usable with apps like Google Authenticator and Authy. Passwords alone are weak security in the modern world. Having two factor authentication gives the peace of mind, to those want it, that your account is secure even if the password is discovered.

In addition, it should become a requirement that all VRChat moderators and developers enable two-factor authentication on their accounts.