Multi-factor authentication alone cannot secure OAuth

The fact

Companies must enforce least-privilege scopes and monitor authorizations.

Rapid revocation of compromised access is key to limiting damage.