Once a session token is hijacked, even if the account has 2FA enabled via SMS verification codes or hardware keys, it becomes useless, because authentication was already completed at the time the token was generated.