People have bank passwords, social media accounts (which can be used in all sorts of nefarious ways), etc. Some may be 2FA protected, some may not be. Some may be protected by bad faux-2FA.

Just because there aren't million at stake doesn't mean you can't bring someone to ruin.