2fa is great and I think it should be often a default. However it’s also not a magic bullet. I’ve read about people fall for scams e.g. someone pretending to be apple, asking them to disable 2fa or give them the code so they can fix issues with their account.