Well once the authentication token expires, they would need to phish you again to get another 2FA token, so there is that. But that is probably plenty of time

Well once the authentication token expires, they would need to phish you again to get another 2FA token, so there is that. But that is probably plenty of time to do some harm, and depending on the service, possibly even disable 2fa (although a good site will require another 2fa authentication in order to do so).