Are these credentials all that are needed to impersonate your authenticator?

This seems "bad" - as I'd personally expect there to be no "magic" data migration path between different apps.

There should be a confirmation step from the security manager at least.

I'm familiar with the 'extract from a backup' vulnerability for any information stored on Android. However, I'm more concerned that another (non root-privileged) app can access credentials without confirmation.