People have bank passwords, social media accounts (which can be used in all sorts of nefarious ways), etc. Some may be 2FA protected, some may not be. Some may be protected by bad faux-2FA.
Just because there aren't million at stake doesn't mean you can't bring someone to ruin.
Most users are going to be already logged in on their phone apps so they won’t be affected. And the inconvenience is most likely going to be chucking up a captcha to prevent automated attempts.
Just because there aren't million at stake doesn't mean you can't bring someone to ruin.