It may worth mentioning that 2FA is used properly only if the "signer" device is different from the one you use for browsing/logging in.
If you have the 2FA app on the same (maybe compromised) device, you will remain in the (bad) loop.