There's another advantage to SSL client certificates that this article doesn't mention: it allows the server to know that the connection isn't being intercepted by an attacker.

With passwords or even many 2FA solutions, an attacker can just replay them to the server, and the server has no way to know that they're not coming directly from the client. But SSL client certificates cannot be replayed by the attacker, so if the server receives a valid connection with a SSL client certificate, it knows that it could only have come from a client with the corresponding private key.

There are proposals to also be able to authenticate the client in a non-replayable way with passwords (like TLS-SRP), but AFAIK they haven't been implemented in any browser.