Yes, but 2FA is usually another app, not email. Or even if it’s the same app being in your very password manager, it gets the second password from the algorithm. So if you steal my password, you can login. But stealing these 6 numbers that work for just 30 seconds is useless.

In a proper authentication system you'd still have to provide the 2nd factor after resetting your password. Resetting OTP should require recovery codes that you got when you set it up.