you need 2fa to log in and withdraw coins but not to release from escrow. that is the prerogative 0f the seller/buyer.
Yes, you do need 2FA to release from escrow. At least on my account you need that. I just checked and there was no option to choose when 2FA will be used.
In theory, someone could use one of those cell towers that are meant to spy on people using the cell tower. (there is a thread in politics and society about this). The attacker could make it so your cell phone does not use encryption, requests a 2FA code they know will be delivered to your phone and then intercept the code, and not deliver it to your phone. If they know your account credentials then they would have access to your account.