A separate password for each site works fine. 2FA is mostly a PI grab for spyware anyways. E.g. "Login with Google" is spyware.
I want 2FA for my bank only.
Edit: SMS would give them your phone number, but SMS is a really bad 2FA and should not be used
What is sad is that misuse of 2FA data is rampant and causes people to think (rightfully so) as you do.
I get lots of unsolicited "Microsoft Login" popups and even as a sophisticated user, there's no satisfactory way for me to establish whether this is a trustworthy request or a fake login page.
For example, my company's VPN uses Microsoft SSO and will occasionally pop up a Microsoft Login window without me having requested it.
Yes, this is not bulletproof, because some companies have login pages on multiple domains. But at least it fails safely and causes me to become cautious when that happens.
From my observations, they would try to type in "the" username and password to "unlock" the system everywhere, and in the process realizes that special instruction applies, and jumps to an ever growing switch-case statement in the exception handler, that routinely skips and punches through the bottom. No matter what or how I speak about an identity being a set of [domain,id,secret], it would not stick. The schema was carved in stone long ago and isn't changing. I've naturally tried converting them to a password manager, it didn't matter. Falling into installing WinZip, twice, and subsequently paying for it was far easier than using it, apparently. Whenever a login process could not be completed, the system is considered to have "became unusable", and signup flow is repeated to again "unlock" the system.
To include such kinds of common people, reducing situations that realms matter is crucial. Passwordless login such as SMS and e-mail magic links is one way, password sharing among websites(dangerous) is another, and OAuth/OpenID/federated login is among those.
A user that feel uneasy typing XY account passwords on a browserish popup that claims to be a part of the legitimate "Login with XY" flow is not a normal user. That is a competent, near-developer power user.
Aside from the fact that I can't keep the way the auth flow works in my head for longer than 2 days before my understanding of it becomes fuzzy again, a layman is not supposed to understand what's going on at all. Because if they were, they would ask "does this service get my XY password if I enter it here?" and unfortunately, trying to get this answer will lead them down a rabbit hole of auth flows, OAuth2 vs. OpenIDConnect and whatnot, because it's only ever documented for implementers.
The normal user is to just believe in its trustworthiness, which may on a technical level be warranted or not, that's not the point. If you keep logging in with XY to different services, you become conditioned to not question anymore whether it's correct to enter your password right now, and where the login form, which always looks the same across different services, comes from.
But oh well, I don't know what the solution should be here, maybe mandatory 2FA yet again, or passkeys. The market will decide.