It's about accountability sinks. The purpose of requiring the second factor is for the company to blame the user when the user gets hacked. It has very little to do with actual security.