Granted the forms of mfa available without a hardware key are far from perfect. But they are better then no extra authentication method.

A good plan violently executed now is better than a perfect plan executed next week