In my opinion, there is more Memsource should do with passwords security.

Local accounts (non-SSO) are relatively unsecured since the passord strength is relatively low and 2-step is not something an Admin can impose. 

I'm not too worried about the linguist accounts, which has limited access, but if an Admin or PM account is leaked, hackers could easily have access to company confidential information, such as sensitive/unreleased documents. 

So I agree that Admins should have more control about their users passwords and be able to set policies, such as 2-step, password rotation, etc...