From the whitepaper (https://github.com/kholia/dedrop/blob/master/paper/accepted/...):

We found that two-factor authentication (as used by Dropbox) only protects against unauthorized access to the Dropbox’s website. The Dropbox internal client API does not support or use two-factor authentication!