Passwords get reused, phished, and leaked. A second factor is something the attacker is unlikely to have at the same time: a code generated on the user's phone, a physical security key, or a fingerprint. NIST describes factors as something you know, something you have, and something you are, and two-factor means using two of those kinds.
Not all second factors are equal. A code sent by text message is better than nothing but can be intercepted or redirected through SIM swapping. Authenticator app codes are stronger, and hardware keys or passkeys are stronger still because they resist phishing pages that trick people into typing codes.
Turn it on for every account that can change your app: your code host, cloud provider, database dashboard, domain registrar, email, and payment provider, and require it for admin users inside your own product. Save recovery codes somewhere safe. If you build 2FA yourself, use a proven library, rate limit code attempts, and expire codes quickly instead of inventing your own scheme.