When I have to do faux-2FA auth using numeric codes sent by text or email, I sometimes catch myself quietly saying the numbers. A microphone would by quite handy for an attacker, even if they couldn’t see all my network traffic.