If it’s just one of those 2FA code generators, that still won’t help if your phone has malware on it. The malware can just modify the transfer as you are making it and have typed in the code.

Users would also lose them far more than they lose their phones.

I have one of those 2FA code generators, and used to have a different one with a business account, too.

In both cases the authorisation challenge/response involves part of the destination account number, so if the details are tampered with by malware the code won't work.