[...]This discussion has prompted me to send an email on this issue to my GoDaddy account rep, so we'll see what happens. If they bring in two-step authentication soon, I'll stick with them. Aside from the lack of this security feature, I've personally found them excellent to deal with.
I've heard back from my account rep and they've suggested a solution that I'm happy with for now. I did reiterate though that two-step authentication should be implemented.
Premier Service clients can access a free security feature called Domain Transfer Validation Security (DTVS). Basically it means that they'll call you if a domain transfer out or change of account is initiated, once you provide a PIN and verbal approval the transfer continues, otherwise it will be declined after 72 hours (3 days).
This won't solve the problem for people that only have a few domains at GoDaddy, as they won't have access to the DTVS service.