The least secure part of the sign-in process is the person. It doesn’t matter what the 2FA method is.
You can be using a one time pin and someone can look at your paper and see the next one. Someone can trick your grandma into giving out the Google authenticator pin over the phone because “they’re from Google”. Someone can trick you into making the financial transfer yourself because “you’re getting a deal”.