There are really two aspects two 2FA: 1: you as a user might want to protect your account 2: A website provider wants to secure their own business If it's ab

There are really two aspects two 2FA: 1: you as a user might want to protect your account 2: A website provider wants to secure their own business If it's about 1, then the argument "I don't reuse passwords" hold some water. It doesn't protect you from somebody getting access to a plaintext copy of your requests (for example on the load balancer that terminates the TLS), but that's only a small part of potential attack surfaces. But from the perspective the website owner, they might suspect that many of their users reuse passwords between sites. 2FA is a great defense against that, and also against brute force attempts.