I think that 2FA is widely required not to protect users of online services but to protect the services themselves and/or their administrators from a burden of

I think that 2FA is widely required not to protect users of online services but to protect the services themselves and/or their administrators from a burden of annoying work. Users that create accounts with weak passwords because they don't care about their accounts present a problem for the company behind the service, because their accounts will eventually become used as puppets of spammers etc. By requiring a very complicated login procedure, spammers won't try to hack those unused accounts and exploit them, resulting in less email being sent to abuse@. And I think that's the most probable reason 2FA is _required_ today on most online services.