An old password attack usually means:
Someone got your password from a past data breach
Or they’re trying previously used passwords (“password reuse”)
Without protection, that can still work if you haven’t changed it everywhere.
MFA stops old password attacks because:
Old passwords alone are not enough anymore
Attackers can’t access your second factor
Even reused or leaked passwords become useless