That’s not correct, you can log in by username.
2FA will stop anyone that steals your password from reuse but DIDN’T get malware into your computer.
Even in the worst case, you still have SSH access to the server and can restore your access from there.