It’s really important to set up passcodes for iOS devices. Without the passcode passwords typed in Safari are viewable by anyone. Pretty dangerous stuff.
If I carry my device with me outside this is one step of security that I just never skip. Anyway, Touch ID just really works.
I already have to remember my OSX Password and iCloud Password. If I enable two step authorization I also have to remember iCloud recovery key. But that’s not all, in the case of using two step authorization, Apple also requests me to create app specific passwords for any third party apps that access iCloud. The last part is a deal-killer for me. That’s just too many passwords.
If you do however choose enable two step authorization, make sure not to forget the recovery key.