For me what this misses is the reduced impact of a single session compromise. If an attacker gets your password, that account is compromised until you change y

For me what this misses is the reduced impact of a single session compromise. If an attacker gets your password, that account is compromised until you change your password (could be weeks months or never). with decently configured 2FA, the attacker gets a single session. If you have decent session termination/logout and restrictions on sensitive actions (like disabling 2FA) such that they require re-authentication (And re-entering another 2FA code), it can reduce the impact of compromise by quite a bit.