Many employees at large companies don't fully understand how 2FA works and how easily it can be exploited.
Most people are trusting and don't want to rock the boat, that's how social engineering works. They receive a call from someone they think is 'IT' and they want to help and be a good person.
Social engineering exploits most people's natural instinct to want to help and be a good person, not realising that challenging a request for a code that they don't fully understand could stop the attack.
It's an education issue, and I blame that on the company under attack, not the employee that got socially engineered.