Having malware installed on every users phone is so many orders of magnitude harder than downloading the latest db dump and testing the email/password on every other site.

At the bare minimum, TFA stops most attacks. That's a whole lot better than the current situation.