Debit cards in the US are still mostly swipe + PIN or chip. With the ATM there's daily limits of withdrawal amount but that's it. Maybe some issuers have a 2FA feature but none of the banks I've used have.
The issue is that you can process most debit cards through the credit network without the PIN for convenience.
That said, PIN isn't terribly secure either; for a common 4-digit PIN, there are only 10,000 possibilities. Too many to test by hand, but trivial to automate if you have access to the algorithm. And for the first PIN cards, the data was on a trivially readable magnetic strip. So if you have the algorithm and the contents of that mag strip, it's trivial to just run through all possibilities. That algorithm was a closely guarded secret, but still, security by obscurity isn't great, so later they replaced the mag strip with a chip that doesn't spill its contents so easily.
So not all 2FA is a guarantee for good security.