Two-factor means a password alone is not enough. Even a stolen password fails without the second step. This single setting prevents the majority of common account takeovers.
SMS codes are better than nothing, but phone numbers can be hijacked. An authenticator app on your phone (Google Authenticator, Authy, the one built into your password manager) is safer and not much harder to use. Set it up once, use it forever.