They don't need to know it. To reset your Google password you need your backup email account (Facebook / Work email ) or your telephone number or text. All of these are almost invariably accessible without further authentication via your phone. The protection that 2-factor authentication adds doesn't apply in the event that someone has the second factor. We're talking about the incremental improvement rather than the protection granted by your password.