Going to need a lot more context than that.

I’m sure site admins could just clear the 2FA field if they wanted. Would they? IDK, probably not unless they had good reason.

Could someone steal your session information and disable your 2FA with that? Yeah, but I doubt they did, you’d have to have your system compromised or some kind of cross site scripting.

Did you use any shady lemmy clients?

etc