networkn:It simply defies belief there is no 2FA still
Not really. There's little of any interest to attackers there, and adding 2FA on top of everything else would lock out about 95% of the population, if not more.
Heck, MyVaccinePass is already excluding a good chunk of the population even without 2FA.