Note: While this question focuses on 2FA, it can be framed in broader terms: Can a process that undeniably offers a specific feature be perceived as possessing that feature, even if users don't acknowledge it?
It is true that if a feature is not perceived as a feature by a person, it is missing the affordance for that person. That means that that person will consider that feature to be non-existent.
But security is not an affordance, but the fact that you can enter your login details to get to your account is. Logging in is never a goal of a user, it's a necessary step to get to the goal. The actual goal is behind the security steps, on the account page of the user. And when you add an extra step it is only an extra distraction from that goal. We people have a very limited short-term memory and 2FA adds a few dangerously distracting actions to the login process: If you're not already working on your mobile, you'll need to pick that up first, then you have to open the authentication app and copy the code over or remember it and type it in elsewhere. It's probably more effort than most people are willing to do. And most people won't even understand why it's needed or why it makes the application more secure. But that misunderstanding doesn't make the application less secure.
The bottom line is that you don’t “use” security. It’s just there. If 2FA is proven to be more secure but people don’t perceive it as such, the feature of added security may not be there for them. But the application (or process) using 2FA can still be considered (and is still proven) to be secure. If 2FA is what you want to protect people’s accounts, you just need to find a more convincing way to sell it.