It mitigates the simplest forms of phishing. If someone is running a proxy server[0] and passing everything along to the real website, token (or SMS) based 2fa can't do anything.

[0]https://breakdev.org/evilginx-2-next-generation-of-phishing-...