Due to a recent Google change, MFA isn't truly MFA.
Google's app for generating MFA codes syncs to user accounts by default. Who knew?