Most people use their phone as 2-factor. So if a thief has your phone, 2-factor with a phone is pointless.