It requires something you KNOW plus something you HAVE. A stolen password alone is then not enough to get in.
Someone with enough of your personal details persuades a shop to move your number to their SIM. Your phone loses service; every SMS code now goes to them. This is a real and common attack in Kenya. If your phone suddenly loses network for no reason, treat it as an emergency and call your provider immediately.
When you enable 2FA you are shown one-time backup codes. Save them somewhere offline. Losing your phone with no recovery codes has locked people out of their own accounts permanently.
Email first. Then anything holding money, then social accounts. It takes about two minutes per account and prevents the single most common form of account theft.