Every bit of information that could be used to identify you to the server can also be spoofed.
The 2FA used every time is as close to secure as can be reached.
IT STILL FAILS when people are stupid, and you want it to become less secure?