it is hard to attach a 2FA on a decentralized network

The reason why this is not implemented has nothing to do with decentralization

because it ... does not store your account key

Yes it does, but the public key only.

it just accesses them from your device.

No it doesn't. The network can't access a key stored on a device. The user signs transactions using keys stored on their device and then sends the signed transaction to the network.

there is a way you can recover keys

hive.recovery is not a tool to recover keys but to recover your account (i.e. to assign new keys to your account with the help of your recovery account)