It is a little bit hidden, but Mastodon does support 2FA: Edit Profile -> Account -> Two-Factor Auth
@sans_isc it also supports passkeys, U2F/FIDO keys, and (obviously) OTP apps