> No reason 2FA can't be just two passwords

That's not two factors, that's one factor (something you know) twice, even if it is different passwords.