Apparently, from a related article, the hotels do have 2FA.

https://www.theguardian.com/money/2023/oct/23/bookingcom-cus...