In short: two-factor authentication is a login in which, besides your password, you prove it's you with something else — a code in an app, a physical key or a fingerprint — so a stolen password alone is not enough.
Simply put: There are three kinds of proof: something you know (password, PIN), something you have (phone, key) and something you are (fingerprint, face). Two different kinds make a double lock. Automated programs try millions of leaked passwords — the danger is not how important you are, but a reused password without a second factor.
Example: Someone steals your email password from a leaked database. Without the code from the app on your phone, they can't get in.
Watch out: a text-message code is tied to your number, not your phone — the number can be moved. ENISA advises: if you have the choice, use a passkey, a physical key or an authenticator app.
What to do: turn on a second factor at least for your email and bank. Keep backup codes on paper. Never share a code — not even with a "bank employee".
Source: ENISA — Cyber Hygiene: https://www.enisa.europa.eu/topics/cyber-hygiene