Right but the point they're making is it's a lot easier for a third party to intercept a code that has to be sent to you than it is for them to get the code from an authenticator app since they're generated on your device. At that point you pretty much need physical access to the phone.