Comment by kennywinker

> 2fa using an app that exists on the same device -- a second factor that secures nothing

If I steal your device, and you didn’t have faceid, I have both factors. But if I steal your password, or find it in a leak of another site because like most people you re-use passwords, then I only have one factor. It still provides a fair bit of security because of that.