Sure, it raises the bar, maybe I should have said it's not entirely effective, rather than it'd not effective. Long story short, if you want your corporate logins to not get phished, 2fa with codes (or push to accept in an app) isn't sufficient, although it may reduce the rate.

It does nearly eliminate other classes of attack (depending on details: if you're using six digit codes, 1 in 1M isn't zero; if you're using app to accept/deny, some users will say yes when it wasn't actually them)