So they have something you own, they broke into your phone, and they have something you know, they brute forced your PIN. How is that not still 2FA? If someon

So they have something you own, they broke into your phone, and they have something you know, they brute forced your PIN. How is that not still 2FA? If someone breaks into your computer and you happen to have written down all your 2FA setup codes in a text file, you’re still using 2FA even though they now have access to your codes. I don’t fully know the mechanics of the Secure Enclave or Android equivalent but I would be surprised if it allowed exporting private keys without some form of authentication, separate from unlocking your phone. You have to reauthenticate each time you use your passkey, likely on purpose.