A stolen password is defeated by a second factor. A stolen session cookie is the second factor already satisfied.