Just because a password field in a web form is susceptible to various methods of attack doesn't mean its not a factor of authentication. And the same goes with

Just because a password field in a web form is susceptible to various methods of attack doesn't mean its not a factor of authentication. And the same goes with SMS. It's still 2FA, just not absolutely secure/reliable. Also there are lots of use cases where there just doesn't seem to be any more practical option for developers. For example, a second factor of authentication for financial transactions where the requestor only has a feature phone. Or the far more common scenario - where the practicality of rolling our hardware dongles, custom authentication applications is just too difficult/expensive.