is this two factor authentication actually used to keep your private key secure or just to let you log into the site?
Same question was essentially covered here:
The 2FA is to protect against a replay attack using your password to access the Blockchain.info website. It does not protect the backups.
Someone with your blockchain.info/wallet password and access to the encrypted wallet file can decrypt the file and spend your funds.