But what's the value of stolen card data? It always requires 2FA to be used. It's just routing information to your bank.

Are there still cards that work without 2FA?