Incredibly important in all things security: you're only as secure as the weakest link in your security chain.

I could have an air-gapped network with 2FA on everything, but if I allow employees to plug in any device they'd like into a USB port, all I have to do is drop a few Rubber Duckies in the parking lot and it's over.

2FA is not any different. The second factor can be compromised just like the first.