Those are awfully dangerous on their own these days.

As soon as a poorly salted hash leaks or gasp, a hash with no salt, it’s super easy to reverse those passwords now.

2FA severely reduces the danger of rainbow tables and keyloggers. The only real worry with 2FA is login replacement and interception. and passkey solves that, allbeit at the cost of complexity.