The point is to slow down attacks. The point is not that it's fool proof. I always see 2FA as not a way to secure your account. More like a way to mitigate illegitimate attacks from 3rd parties and script kiddies. So they can't get in to 100s if not thousands of accounts all of the sudden.