In the wild, there is a method of bypassing 2fa. The gist of it is that the attacker doesn't just phish the password, but they also phish the 2nd factor and use those for a real login on their own machine. (described in detail here https://www.wandera.com/bypassing-2fa/). In this attack scenario, 2fa gives a false sense of security and makes it more likely to fall victim to phishing. After all if my only protection against getting phished is checking the certificate and URL, then I'll be more likely to double check it compared to just having bought into a brand new shiny 2nd factor that touts itself to be fool proof.
If I get phished like this with the 2nd factor, the hacker is in and as long as they don't log out, they can stay in for a very long time causing all kinds of trouble.
Clearly the 2fa has a disadvantage of creating a false sense of security. The only advantages I could see is for users who share the same password across different services or for making subsequent logins using the same credentials impossible. Aren't those advantages too small relative to the disadvantage?
Obviously the answer here is re-education. Tell users to use 2fa but be keep being vigilant - make them aware of this type of attack and how nasty it is even with 2fa. But that's hard to do considering how many 2fa solutions are pushed as "THE" ultimate final solution for phishing. It's just not true and in many ways it makes the problem worse - especially for websites. Am I missing something?