If you aren’t using 2FA for your root account, then you are asking to be compromised.