This is your best defense. Even if an attacker "brute forces" your password, they cannot log in without a secondary code from your phone or an app.
: Combining dictionary words with numbers or symbols (e.g., "Rover2020") to bypass basic password requirements. Facebook’s Modern Defenses brute force attack on facebook account install
After a few failed attempts, Facebook will temporarily lock the login or require a CAPTCHA. This is your best defense