Presumably the 2fa is just for the login, and the user would already be logged into paypal on their computer.

Your paypal account getting hacked isn't a Big Deal, you aren't going to lose any money over it. In fact, managing that is paypals entire business model.