That's the way, using strong passwords and changing the password with or without any hack periodically...
Why bitcointalk don't use a 2FA? It would be nice for security
Because it is forum based on old software in times when no one even heard about 2FA?
And new forum software which will probably use 2FA functionality is in development for couple years already.
So there is very little reason to waste time and effort to update current version of Forum with new features.
2FA is unnecessary to a forum, we use 2FA on cash or crypto coin related accounts, such as trading site accounts, dark market place site accounts.
If the database of bitcointalk is leaked, 2FA wouldn't work because our passwords are compromised. Hackers can try your passwords on other bitcoin sites, try to steal our money. They know analyze the passwords using social engineering knowledge.
2FA would work even if your password is compromised. Even if the hacker has your password they would be stopped by needing your SIM card to get past the 2FA layer of security. That's why the sequence is username/email, password, 2FA and not username/email, 2FA, password.
2FA blocks a ton of things, and as long as your company doesn;t give out a copy of your SIM card to anyone who calls them asking for it, you should be fine for the most part.