What is the key security change when a password-only login is changed to require MFA?
The code replaces the password so only one proof is checked.
The password is typed twice, creating two independent factors.
A valid password is no longer sufficient; login also requires a code derived from a separate protected secret.
The public username becomes the second secret factor.