> I don't think the attacker could reasonably expect to get you to enter two 2FA in a row.

Just tell the user the first one failed, and ask them to enter another.