Also, we don't currently log abandoned logins (ie. a multistep form where a later step is never submitted and the session times out), but a successful password check followed by a 2FA screen that never gets submitted should ring alarm bells.

Is this alerts to a user of their failures, or more generally for WMF deployment? Or both?

I was thinking of icinga-type alerts. But adding 2FA alerts to LoginNotify (T140167) would be nice too.

A brute force attack on a 2FA enabled account is kinda impossible since the code changes every 30 second and you have 10.077.696 possible combinations i personally think the web server is able to handle that many request in 30 seconds

This is a common misconception, periodically changing the code does actually very little against bruteforce attacks. (It is there to protect against replay attacks.) The attacker would just keep trying numbers at random; the expected amount of attempts needed is approximately same.

The easy option here is to just increment a counter in statsd for each 2FA success and another for each 2FA failure. We already do the same for login (c.f. https://grafana.wikimedia.org/d/000000004/authentication-metrics?orgId=1) so I'd think there's no issue with making this data public?