Compromising a user password does not grant access to the web client (where all the important settings are at) if 2fa is enabled. App specific password only all

Compromising a user password does not grant access to the web client (where all the important settings are at) if 2fa is enabled. App specific password only allows data exfiltration and most enterprise email servers/authz systems can be configured to automatically block access from VPNs/foreign ips. These days emails are tied into calendar and Oauth and many other things, blocking access to the inbox is just one layer in a very a big picture.