I heard other similar reports that 2FA in Lemmy is kinda buggy so I haven't tried to set it up myself yet.
That asides, I heard that the vulnerability would not be stopped by 2FA because it steals the "logged in" cookie, so they are "already logged in". Edit: lemm.ee is not vulnerable in any case.