> unless you opt in to cloud providers holding your data there is no easy way afaik to migrate your authenticator apps to another phone.

You could self-host Bitwarden/Vaultwarden, or something like that.

> don’t get me started on apple’s unpredictable model of sending 2fa to some other “trusted” device which means tou never know what tou need to bring with you.

I think they send 2FA to all supported devices on one's Apple account?