Except it's not actually 2FA if all it takes is an ssh key to push. That's only one factor. Doesn't address the threat model of compromised developer machine.
But it's significantly easier, like way way easier, to phish someone versus compromise a filesystem and extract SSH keys. And you can just add keys afterwords if you phish them, so why wouldn't you go the easy route? That's why phishing is still such a massive problem: because it works.
If your SSH key is encrypted, it’s 2FA.
Either way, it’s not phishable (unlike passwords) so it’s way safer.
Derive you SSH key from a GPG key stored on a YubiKey[1] and even if you comprise the machine you don't get the keys.
Yes, if I need to fish out my phone and put in a code every time I need to git fetch a private repo, I will do everything I can to convince anyone who will listen away from GitHub