What if my system gets compromised and someone has access to the 12 word seed phrase BUT not the pass phrase (extension words), is it still safe?
If your seed phrase has been extended by passphrase, both seed phrase and passphrase will be needed.
Note that if the passphrase is simple, there's a probability that it can be brute-forced.
As for 2FA, I feel like I should add that for extra security, is it necessary?
Even if your wallet is 2FA, anyone who has access to your seed phrase (+passphrase, if there's any) can steal the fund without accessing to 2FA code.
My concern for 2FA is if it goes missing, then what?
You can disable 2FA using your seed phrase (+ passphrase, if there's nay)
You can also keep the secret key in a safe place and recover the 2FA in future.