people's phones have their passwords from their google/firefox accounts, their email, and tend to be their 2FA device for google authenticator... not really 2F

people's phones have their passwords from their google/firefox accounts, their email, and tend to be their 2FA device for google authenticator... not really 2FA anymore to be fair if you are running the latest android or have an iphone that's probably better than having it all on your exploit ridden PC, but it's still 1FA