Yeah, "strong password" is necessary but not sufficient. The knowledge of your password can be leaked but your physical device can't. There are legit arguments

Yeah, "strong password" is necessary but not sufficient. The knowledge of your password can be leaked but your physical device can't. There are legit arguments against SMS (the cell phone provider's customer support and the SS7 are weak points) and badly implemented 2FA, but 2FA definitely has security value add.