> Actually, it's 2026 and has been for six weeks.

D'oh. But fair.

> There are many other 2FA authenticators available.

Specified by job, so no choice in this matter.

> I would refuse anything work-related on my personal phone.

Quite reasonable as a general rule, though my then-employer only required the 2FA app and nothing else, and in this case it would've just meant "get an additional phone".