It's also important to know your threat model. Namely, random attacks versus targeted attacks. Shitty 2fa will still deter people who get a list of a hundred

It's also important to know your threat model. Namely, random attacks versus targeted attacks. Shitty 2fa will still deter people who get a list of a hundred million emails/usernames and passwords and try them on banks, Twitter etc from putting in the extra work to break into your account specifically. If you expect targeted attacks - from governments, because you oppose them, from determined criminals, because you have a lot of nice stuff to steal, or from people around you, because you know too many assholes - maybe it might as well not exist, but for most people, most of the time, any 2fa is better than none.