Given the security setting, I am comfortable with the tradeoff. I do not think brute-force attacks represent a significant risk, especially compared to other attack vectors.
That may change over time. Fortunately, it's straightforward to increase the default key size.
I think people are confusing the Authy Google Authenticator Support with the Authy product.
We do not sell Google Authenticator or aim to be a replacement for it. We simply added the possibility to add Google Authenticator tokens into the Authy App - mostly since our existing clients wanted this -.
Our Service, it's usage etc are completely separate.. If you are not using Authy you can simply use Google Authenticator App.
The only thing in common is we both use RFC 6238 which is an open standard for Time based OTP's.