Because 2-factor methods are not limited to phones or apps. You can use your pgp key which is likely what most of the darknet markets use.