The second factor is not meant for securing you against a compromised system and if you really think about it you already lost mostly when your system is compromised (stealing sessions credentials etc). The second factor usage is to secure that you are really you and securing a service against external unknown logins.
The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me".
Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.
The attack vector is the following: Somehow a hacker gets your username and maybe a password you use often or using an brute force attack on an internet service. The second factor basically asking: Is that really you? When the second factor is on the same device (which you own) then that's also a valid way to say "yes, it's really me".
Also think about it: When you login on a phone browser or phone app both things are on the same device. Same logic.