2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session c

2FA doesn't necessarily require entering a code. A lot of 2FA schemes use a push notification where the user confirms the login on a separate device. Session cookies are a problem, some services provide a way to invalidate all session cookies, but it's often buried deeply in settings and users aren't aware to find the button after a compromise.