An Apple ID protected only by a password is vulnerable to credential leaks from unrelated services, since many people reuse passwords across different websites.
Two-factor authentication adds a second verification step, typically a code sent to a trusted device, meaning a leaked password alone is no longer enough to access the account.
Because Apple ID often controls iCloud backups, Find My, and payment methods, the extra thirty seconds it takes to approve a login is a small cost for meaningfully reduced risk.