If someone has given their email and password to an attacker, they won't think twice about giving the 2FA code as well.