Implement notifications (ideally, both email and phone push notifications) for every critical operation in the account lifecycle (email change, password reset, turn off two-factor authentication, account linking). Rather than picking and choosing, if it’s critical, it’s best just to protect it.