I've setup 2 Factor auth on all my apple devices (iMac, MacBook Air, iPhone, iPad Pro) but it doesn't work how I would expect and isn't like other services like Digital Ocean, CloudFlare etc.
For example, say I am using my MacBook Air and try to sign into beta.apple.com. I get the promo for
Your Apple ID is being used to sign in to a new device (Do not allow, Allow).
If I click allow I see the verification code so I can enter it on the website. If my MacBook Air was stolen and they had my Apple password they would be able to gain access to my account.
This is unlike one of the services I mentioned above where I use Authy which is on my phone. The attacker would need access to both to be able to get in.
Why doesn't the verification code from apple get sent to separate devices, or use a third party app?