The main issue I have with Authy is caused by their apparent efforts to convince websites to implement two-factor authentication in such a way that it exclusively works with Authy, despite offering no advantages over TOTP. (My understanding is that the API effectively creates a TOTP token, which if you can intercept, can be used in a normal TOTP client.)

Cloudflare used this for years, and Humble Bundle uses it right now. It is hard to understand why this is a thing if Authy is not paying companies to restrict a critical security feature to users of their app.