[daveFNbuck]

Suppose you mistype your password and get a page saying "wrong password, log in anyway?" You click yes and are logged in to your account. Would you consider that account to be password-protected?

To me, a second factor that can bypass the first factor is exactly the same as this situation. Being able to hack your way into an account is a different issue.