One of the few things about Bluesky that's still concerning is we lack MFA or even real TFA. The only secondary authenticator besides your password is an email authenticator, i.e., they send you a code via email.

It's not the most secure method but it's all we have right now. Enable it in settings.