It's not really password leaks for the most part nowadays. It's phishing campaigns, which show a fake Steam login page and also ask for 2FA. They then immediately log in (automatically) and save the token, which is what keeps you logged in. They then follow up by changing the password and removing all your devices.
MassExplosion213 t1_j1nkrxc wrote
Reply to comment by ZsaFreigh in LPT: Got a Steam gift card for Christmas? Hold on to it after you put the code in. If your account gets hacked, you can use the old code to recover your account. by Worst_Support
It's not really password leaks for the most part nowadays. It's phishing campaigns, which show a fake Steam login page and also ask for 2FA. They then immediately log in (automatically) and save the token, which is what keeps you logged in. They then follow up by changing the password and removing all your devices.