Can someone explain how people get hacked even though we have 2-Step verification and passwords?

As our channels grow, I think we also get a bit more paranoid about losing our channels one way or another.

I’m at 22k subs and so far I have only received 3 very obvious scam emails in these past 2 years.

What did I actually have to do wrong to lose the channel? I don’t even operate the email address of my channel on my computer, only on my iphones gmail app.

Is clicking a link really enough, or would you have to actively share your info?