This is a special post for quick takes by anaguma. Only they can create top-level comments. Comments here also appear on the Quick Takes page and All Posts page.
I'm not convinced that this is a reasonable threat model?
1. I believe the main benefit of 2FA is it makes phishing harder, and phishing isn't that relevant to Mythos from what I understand. A secondary benefit is that it protects you against password DB leaks, but that only matters for websites that have crappy security because a DB of hashed and salted passwords is effectively unbreakable.
2. LW doesn't have much financial data or personal data so it's not a juicy target.
Could be wrong though, I'm just speculating here.
Regarding (2), I suspect you could do a lot of damage by posting a link to something malicious as a trusted user, but I don't think 2FA really helps for the reasons you say. 2FA is relevant to phishing and the Mythos risk would be hacking LessWrong.