The fact that malware can steal Google Authenticator TOTP seeds, means that non-malware apps on your phone—e.g. other TOTP apps—could also steal (i.e. import) these seeds, no?

I’d quite enjoy if e.g. 1Password would import all my Google Authenticator tokens into itself automatically. I’ve been meaning to move them over for a long while now, but it’s a whole process, since there’s no place in the Google Authenticator UI to retrieve the original seed value.