This is like arguing that a seatbelt is useless because it doesn't help if someone plants a bomb in your car. You have to have a threat model to talk about security: in the case of MFA, it protects against someone getting your password without your knowledge — whether or not the remote site is compromised is outside of that scope. MFA does help in one scenario related to that, however: when someone compromises SiteA and gets your password which you also used on SiteB, they can't use it if SiteB has MFA setup — even if they compromised SiteA's MFA implementation. That's a pretty useful characteristic in an era where breaches are common.