What if the users had no 2fa at all? attackers still had their passwords and their emails, and their sms numbers