I doubt 2FA can keep anyone safe from an aggressive state actor (a company would just skip the code) but for protection against regular scammers I’d prefer to hold multiple physical devices that can act as a code provider.