This thread is a perfect example of why security is hard. Even if you give users the tools to improve their security (2FA apps), and even if you enforce they they use those apps, users will always find a way to create a loophole that completely negates the security enhancement you implemented.

If you’re putting all of your OTP codes in your password manager, that completely negates the entire point of two factor authentication.

And sure, maybe you think “well I’m not a high value target anyway, I don’t need to really secure my devices”, how many of you have work-related accounts signed into your devices? Even if you’re just a lowly engineer, I can guarantee you absolutely are a target of sophisticated hacker groups (ironically you may even be more of a target because these groups know that you don’t consider yourself a target and therefor are more lax with your security).