Apple’s authentication of those factors, or a separate entry point. It is not certainly not unheard of to leave gaping security holes, sometimes ones which bypass multiple security measures (why the downvote?).

But then they can easily exfiltrate, which would allow it to happen programmatically and in mass.