Yes, you're absolutely right: 2FA makes things harder for the attacker but doesn't really solve the problem. But in practice, at least circa 2018, most phishing

Yes, you're absolutely right: 2FA makes things harder for the attacker but doesn't really solve the problem. But in practice, at least circa 2018, most phishing sites are very primitive. Attackers do OK victimizing people without 2FA, so they don't generally do what you describe ("transparently relay both factors").