Secure enclaves as a second factor break the assumptions of 2FA threat models. If I compromise a single factor (your device) then I can gain both your password and your second factor.
The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication.
Of course, nothing ever stops a user from deputizing malware.
The best second factors are separate devices with their own screens that indicate what you are authenticating to/for before you provide your authentication.
Of course, nothing ever stops a user from deputizing malware.