Whatsapp has announced that they are introducing 2FA to their service. Normally, services rely on a password (what you know), and adding 2FA means that they require an additional code sent via SMS to your phone (what you have), but until now Whatsapp has always used the code sent via SMS and no password, so in their case adding 2FA means adding the password. I am trying to understand why, exactly, this should be useful.
In the common scenario (a service that requires a password, like an email provider), if some hackers violate the site and access the user database, they can crack the password hashes and access users' accounts. Adding 2FA prevents this scenario, because even if they can find your password they still need your phone. So far so good. But in Whatsapp's case, what is the advantage?
Until now, those who wanted to access your account needed to steal your phone (and the code to unlock the screen), then they could do everything (including moving the account to another phone, or changing the associated phone number). Now, instead, they'd also need the password. But who would ever want to do this? Normally one who wants to access someone else's Whatsapp account is for example a jealous wife that wants to check whether her husband is cheating on her. If she can use her husband's phone, unlocked, it means she can read every message, and adding the password doesn't prevent her from doing it, so this is not the scenario that they want to prevent. If Whatsapp supported using the same account on more than one device, the jealous wife could briefly take his phone, get the code sent vis SMS, and configure her husband's Whatsapp account on another phone, unbeknownst to him; then she could keep spying on him even when he is away, for example on an alleged "business trip" (maybe he is careful enough to delete all the compromising messages before he comes back, so this trick could let her discover the truth). Here, the password would prevent her from doing it... But Whatsapp doesn't support using the same account on more than one device, so it doesn't matter.
Any attempt to move the account to another phone, or to change the associated number, doesn't make much sense either, as these attacks can't be kept secret: the victims would immediately notice that the account on their phone doesn't work anymore and take some countermeasures, like creating a new one and informing everyone to stop writing to the old one. Quickly, the stolen account would become useless. A password would prevent this, ok, but I don't think this is an important scenario.
Another case where the password could make sense is if the attacker is a skilled one who can intercept the SMS code used as verification. Again, this would make it possible to steal the account, but since Whatsapp doesn't support multiple devices, the victim would immediately notice that the account on his phone has stopped working, and again the attack would be almost useless.
The FAQ says that "To help you remember your passcode, WhatsApp will periodically ask you to enter your passcode." This would help those who don't lock the screen, but if a user doesn't care about locking the screen, why would he enable 2FA then? And the developers even admit that this periodical asking for the code is to help you remember it, not to increase the security.
The most plausible scenario I can think of is: a criminal gang that can intercept SMS messages from all over the world (!!!) steals accounts, moving them to another phone, and then sends the legitimate user an SMS saying "If you want your account back, send us some bitcoins". A password would prevent this, ok. But, seriously, should we worry about this?
So what is a realistic use case in which someone actually benefits from adding the password?