Is 2fa that big of a deal to a dedicated attacker who gets the victim to enter their info into a phishing page? (Just thinking of passcode-style 2fa, not usb key 2fa.) The attacker just has to forward the victim's login info to a login page, and then if the attacker gets a 2fa prompt, they prompt the victim with a 2fa prompt and then forward the victim's answer immediately.
I understand a lot of attackers don't bother since there's plenty of easier victims without 2fa, but if they're targeting a specific individual, it's not that much more work to make their attack work on 2fa too.