As far as I understand, the story is: casual users don’t choose unique passwords. MFA, even in its weakest forms like SMS, defends against credential stuffing. Indiscriminate credential stuffing attacks based on database dumps, etc. are common enough that this is worthwhile. FIDO/WebAuthn add protection against phishing (because the token is bound to the domain name). Phishing is also a common indiscriminate attack against casual users.

In a world where people used password managers correctly and all the time, this might be redundant, but we don’t live in that world.