Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non

Let's say I've got 2FA enabled. I get a confirmation link to my e-mail. I click the link. Because the e-mail is sent by the real site, the link leads to the non-phishing site. The scammer has my password, but is still unable to access the site. How does that not help? Of course if it's a 6-digit code or something, then they are able to stole my it like they did with the password.