> I still don't know why apps think a device I carry in the streets is safer [...]
Because MFA requirements have never been about security, only security theater. It's the modern version of the "you must change your password every 30 days" rule.
On the contrary, single-factor authentication is generally fine (MFA is still better, of course) if the single-factor is an authenticator application or, better yet, a U2F hardware key. If anything in modern web security is theater, it is the password (and SMS MFA but that's because SMS is a joke to takeover).
Wat? If my laptop gets infected and the bad actor tries to access my (insert account protected with MFA here), their ability to do harm is limited by spreading things across two devices.
Because MFA requirements have never been about security, only security theater. It's the modern version of the "you must change your password every 30 days" rule.