And, additionally, optionally, you can use a BIP-39 passphrase.

I see it as a, kind of, equivalent of 2FA for Bitcoin.

Is this a right analogy?