@Allen
"patch 1 instruction" seems to be the big assumption.
Not really much of an "assumption", since that's the way the vast majority of secure systems work. It goes back to at least the 1980s, when the copy protection of most PC software was cracked by replacing calls to a validation subroutine with something that always returned success. Earlier than that, of course, if you count the ability to "access 1 account" (i.e., administrator) to control an entire mainframe. Anywhere that trust comes down to the flip of a single switch is vulnerable.
There are experiences I've had myself where we put code in the development and/or testing environment that bypasses authentication/authorization checks in order to make debugging easier. You can do your best to put processes in place to keep that kind of thing from compromising the production environment, but mistakes still happen. Security is hard. 2FA is no panacea.
3f2fd13b875fa3d4a1083ac359f73118ea4fa67832d6317ad317ee3a759a2010