Secure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password

Secure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password and your second factor. The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication. Of course, nothing ever stops a user from deputizing malware.