I thought the whole point of multi-factor authentication is to reduce the risk of breach by having different unrelated means of authentication, each of which is assumed not fully secure.

Wouldn't acquiring the 1st factor access (say, normal user credentials) be subject to similar social engineering attacks ?