Is my 2FA not working, or do I not understand it? I have one wallet on Coinbase.  They say that I enabled 2FA on it and that if an attacker somehow accessed my account, they would not be able to spend because they would not be able to enter the code sent to my phone.

But I have made made two purchases, one spend, and many logins without ever receiving such a code or being asked to enter it.  When I said that, the Coinbase person claimed to not know either and gave me a URI to consult.  Unfortunately, I forgot to copy the URI before closing the chat window.
Go to Account Settings, Security.
The default is to ask for 2FA only over $100/day.
Change it to ask every time.