Phishing is social not technical. If someone persuades me to give overmy password, I can't blame the email provider I never setup 2FA with forletting them log in.