What is the case against using a bluetooth-linked 2fa from your phone the way Google Advanced Security does?