The password manager of the browser is a client-side feature which websites have no control over. Whether or not you use it is your own choice. So if a website asks for re-authentication, and you “bypass” this by having the browser fill in your password automatically, this isn't a weakness of the re-authentication mechanism. If you don't want the password to be filled in automatically, then don't store it in the password manager.
Also note that re-authentication is not only meant to deal with an attacker who has compromised your browser or device so extensively that they can use the password manager. It also addresses attacks like session hijacking where an attacker has obtained your session ID but doesn't know the password and doesn't have access to your browser's password manager. In this case, forcing re-authentication is very effective, because it completely stops the attack.
Of course 2FA would be more secure than just asking for the password, but then the application would essentially log you out entirely and make you go through the standard authentication procedure. That's not really what re-authentication is about. The idea is that you're already logged in, but the application occasionally checks that you actually know the password and aren't an attacker who has hijacked the device or session. Depending on how often re-authentication happens, it would also be rather inconvenient to go through the entire 2FA procedure each time, so websites might avoid this for usability reasons.
