I protect my RDM via google authenticator. When asked for the code, if wrong, RDM closes immediately. The better approach would be, to allow a second and third try as sometimes, the counter has just run out, this happens..
BTW, any chance to get duo.com as an option?
This seems to be a feature request for both. I will transfer your post to our feature request section if you don't mind.
Currently, we support DUO as a 2FA for the data source access but not the Application access.