It definitely does. But many people don't want to use actual 2FA, or they don't understand the point behind it.

As long as their vault is properly secured (with actual MFA) that shouldn't be too much of a risk, until they get hit with a virus, of course.