I think the point here is that, even if you give away your password, the attacker won't be able to access your account, because you're protected by 2FA.

If 2FA was supposed to protect your password from being phished, then it would have to prompt you for your 2FA code every time you log in, which would be pretty annoying.