It does and you don't even need real 2FA for it.
Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.
Any non-trivial auth token comes with device or host fingerprinting. That's enough to stop this attack scenario in most cases.
For instance, although I have never been to China, I once got a notification from Facebook that someone attempted a password reset on my account from China. This was shortly after the publication of LinkedIn's stolen database of users which affected millions of users including my account.
On a more advanced level, there is a two step process, you authenticate as usual with your password and get a token, then the site will authenticate your device.
The device fingerprinting is totally transparent, it saves and checks some characteristics from your computer, and ensure you come from the same device next time.
For instance, on Facebook you can see a list of known device somewhere. When you connect on a new computer it sends you an email "connected from a new computer is that you?".