The quote is correct. It does not say they're not using a KDF or salting, which you seem to read into it? The keyfile is the "something you have" and the password "something you know", so two-factor checks out, even if it's not a time-based token that people expect nowadays (though TOTP is essentially the same but on another device, extracting time-based short codes from the long key to make it convenient to type over). No matter how good your KDF, a weak or reused password can still be crackable, so a key file can make sense even if you use a salted KDF
Do people usually store key material without encryption at rest?
You're not writing the naked bytes of the key directly in a file.
Anyway, authentication refers to communication between systems. That's not what this is. Decryption is not authentication (except perhaps of the decrypted plaintext, which is not what we are discussing).
