On Conversation 1: 2 Factor Authentication (by definition) requires BOTH a password AND a code or a device. The stupidity is when people deploy what is NOT actually 2 Factor authentication a password OR a code/device or just a code/device, but call it 2 factor authentication . It’s an extremely simple concept that people screw up all the time.

You have to wonder why so many reasonably intelligent people can screw up something so simple so often. Usually the reason is because they don’t actually care about security, they care about convenience. This is why you need auditors.