Having two-factor authentication on a web service via an authenticator app which itself has two-factor authentication to get into it, is probably extra secure but really feels like overkill and is annoying as hell when you’re in a hurry.