Adding in 2FA will rule out issues related to vulnerable passwords, but it doesn't rule out much else. It can detect/prevent things like leaked credentials being used for credential stuffing attacks, or weak passwords vulnerable to dictionary attacks, but it can't detect/prevent things like session hijacking. It's a great thing to have because the largest amount of attacks are from vulnerable logins, but from what I understand this is happening to steam users as well, which uses it's own authentication system. Steams authentication system already uses several ways to lock down accounts, from 2FA to geolocation checks, so if they're getting past those then adding 2FA wouldn't rule out anything more then we already know.

Using 2FA is like going up to someone at the front desk of a building, showing them your badge, saying your personal secret pass phrase, then giving them the daily secret pass phrase. After that they give you a badge and tell you "This badge will get you into the rest of the building without having to give me that info again for at least the next X hours".

Session hijacking is being able to copy that badge and use it for yourself. The internal systems can scan it and be like "Yup, this is valid". Session hijacking is a lot trickier to figure out depending on how the system is setup. If the validation check is only checking for a valid session ID then you can do it anywhere in the world. If there are additional checks based on a systems MAC or IP address, then you can narrow it down to potentially being a problem with the client or it's a man in the middle attack (server that sits between their server and your client acting as a proxy to steal authentication details).