Most exchanges did not have proper 2FA until the sim-swath-swoop of 2018-2020.
The first thing I usually do is enable OTP but I know some companies will still fallback to SMS.