Smartcards are the safest of the common options as far as I know. And if only password or only smardcard is compromised by hacker, the system is safe. Both are needed to authenticate.
What this article is trying to point out is that 2FA as a concept only stops some kind of attacks, but does not prevent all kind of attacks. Furthermore, 2FA has to still be implemented, which leaves the same problems as any other security software. The implementation may be badly designed or have bugs, that have nothing to do with the 2FA itself. It is like RSA being secure but openssl being vulnerable to heart-bleed. RSA is secure but just because you are using it does not mean there is not another problem.
Here is a quick and likely incomplete list of examples what 2FA does not protect you from:
- MITM - An attacker listening in on the line and intercepting your connection. SSL should be used to prevent this, 2FA does not do it.
- Fake website - an attacker making a same looking site and tricking the user to log in to it, then forwarding the credentials (both smartcard and password) to the real site. The attacker can only attack at this time while with password, he could save it for later.
- Compromise of the server - 2FA does not help at all if your underlying server gets compromised, for example with a bug like hartbleed as was mentioned.
- Physical attack - 2FA does next to nothing to stop an attacker with physical access to the machine.
- Attack on recovery method - Such as reset passwod/smartcard by mail. If there is such a recovery option, it can be often abused. This goes both for automated ones and manual ones done by human (social engineering).
- Social engineering on an admin - An attacker may try to convince an admin that they lost their smartcard and they need it reset or disabled to log in.
In conclusion, 2FA is useful but it has to be used in conjunction with other security measures. It is not a single solution for all your problems. I strongly recommend getting a professional to design your security strategy.
Note that some of these might be prevented by advanced designs of 2FA but are not by common ones.