The Risk is subjective to the business area:
Independent apps and services
Independent apps and services like Google's Gmail gain a lot of mitigation through the use of these methods for Multi-Factor. The reason for this is that targeting this base is often remote, and not part of the a targeted plan. It's pointless to spend hours, weeks, and years to profile a single person and incur additional risk by attempting to steal a phone when there is already a lot of soft targets.
These method basically help protect you from people trying to steal your identity and do a pretty good job. Add Geo location tracking on your larger services and you have a pretty good security implementation for the general populace.
Large Corporations and IP
The Risk changes when you look at larger businesses internal structures and what they have that someone might want. You risk shifts from customers (who are too general to target) to employee's (vastly more narrow attack surface) who might provide what you want when accessing a system. We can narrow it down further by targeting employee's of interst such as executives and IT personnel. In these scenarios what attackers are after are a business assets, intellectual property, or access and it's far more worth their time to spend years on it.
Two factor is still important for the same reason that a general user should use them, but you also implement things such as certificate based authentication, phone sandboxing, and other network techniques. These are designed for a business to give confidence that an employee on the network is who they say they are.