The original authentication method was a password for your username. Unfortunately, the first computer systems didn't have the capacity to store long passwords. The first passwords were just words which led to dictionary attacks. Use a word in the dictionary, they used a dictionary to guess passwords, and they could probably get in. The first attempt to fix this was to make you use more "complicated" but still short passwords. See "Passphase, not Password".
Another attempt was to require you to present two "factors": something only you should know, the password, and to prove that you had something by typing in a changing code on something like the SecurID. The rules for passwords did not change, but now we have other second factors. A common second factor is to have you respond to a notification on your phone (Google, Apple). Companies that don't control phone ecosystems may ask you to type in a code sent to your phone number as a text message or in an email.
2FA is well meaning and may help, but you have to be are of several things:
You need to know what form of 2FA is being used.
You have to have a backup if that method can fail … like you lose a phone or lose access to email.
You have to be aware of the attacks that can trick you into sharing a 2FA secret code or into authorizing a login by saying "yes" to a notification.
You also have to be aware that password resets may turn 2FA back into single factor. I have several accounts that require a password and then send an email with a one time code for the second factor, but if I need to reset my password, they send a password reset link to my email. The email is really the only authentication since it can reset the password.
There is also a trend to stop asking you for a password and to instead just send you a code or link in email or as a text message. This is single factor authentication even though it uses a typical 2FA mechanism.