So why would you do two factor authentication? It is about raising the bar for the attacker.
How can you raise the bar for the attacker? By introducing a challenge which is not within the skill profile of the classical attacker.
...like needing the attacker to physically steal something.
This is the originial idea behind 2FA like it was introduced e.g. in 1986 by RSA with their RSA securID token. Unfortunately this proprietary algorithm was not implemented very good, so it needed to be improved continously. Plus: If an attacker steals the secret keys of the hardware devices, again the physical possession is useless.
As John and the NIST stated, SMS is not the best idea to implement 2FA. Obviously it is still better than using no 2nd factor and only a weak password.
But also smartphone apps have their attack vectors. Not only on the smartphone but also during the enrollment process. I wrote shore blog article about that. https://netknights.it/en/the-problem-with-the-google-authenticator/
Finally - if you are speaking of man in the browser, of course 2FA only protects you in the short momemnt of authentication. If you are using an unencrypted protocol, the attacker can simply sniff and steal the data without compromizing your login. If your computer is full of trojans, the attacker can also directly target your data without the need to target the authentication process.