What I got from the article is the malicious app could read the SMS or email which may contain a 2FA code.