Hey George, sure, I can help here.

No, I've never heard of this for accessing an external VDR. Hub has 2FA for Hub Users within an account, but not for those relating to serving external data rooms (I'm not sure how many people would set up a 2FA connection to view a data room just once). We do have multiple options for securing data rooms, primarily differing options of required email inputs, and some automations behind those. Let me know if you'd like me to expand here.

Yes, you can see user roles under settings -> team.

Yes, these are under "Settings" on any data room, to disallow/allow downloading of files.

We don't offer these directly for data rooms, but haven't needed to so far for most use cases. We have a detailed access log for every file and even every page viewed for how long, down to the millisecond, but this is the first time I've heard for a request to export that information. For bulk download of files, we'd recommend just a zip file in the folder, which is crude but effective if there's many different files.

No access expiry based on time / watermarking.