This is the single most effective defense. Even if a hacker has your password, they cannot log in without the code from your phone or authenticator app.
Viruses that harvest saved passwords directly from your web browser. Why Do Hackers Want These Lists? 1.2k VALID HOTMAIL.txt