Another aspect that people always forget is that 2FA protects only the login process.

Any successful attack against your browser (or any other application on your workstation) allows the attacker use existing and future browsing sessions.

The attacker can simply wait until you log onto your bank account and remotely control your browser.