Two factor is certainly effective, but the second channel must be different from the primary channel.
The worse thing one can do is set up two factor with email, and the email is the same email the account has as the contact. Somebody gets the email and they have a wide open pathway.
The advantage of two factor is that the attacker must get though two totally different accounts. And that is not how they work in the real world. There is not some super hacker working on you, just thieves grabbing the easy target.
The email account though is still the huge key to self protection. If somebody gets access, to that, you are toast as way too many sites are sloppy about password recovery.