Yes, but 2FA is usually another app, not email. Or even if it’s the same app being in your very password manager, it gets the second password from the algorithm. So if you steal my password, you can login. But stealing these 6 numbers that work for just 30 seconds is useless.