No, that's not a "hole" in security - this is definitely by design.
The idea behind 2-factor authentication is that a user is required to present 2 separate and different factors of authentication. These factors can be many things, but in Apple's system they are a password (something you know) and a token (something you have) stored on your computer.
This improves security when compared with just authenticating using a single factor, username and password, as was common not so many years ago:
If someone compromises your password and tries to login to your iCloud account from their own computer, they will not be able to login as they cannot produce the 6 digit verification code.
Similarly if someone compromises your authentication token (for example by extracting it from a stolen backup drive) and tries to login to your iCloud account from their own computer, they will not be able to login as they cannot enter the correct account password.
Finally, if someone has physical possession of both one of your trusted devices as well as knowing your iCloud password, they still have one barrier left to pass. For example stealing your iPhone or iPad won't automatically give the thief access to your verification codes - they aren't displayed unless the device is unlocked (using for example TouchID/FaceID or a passcode).
Should someone know your iCloud password, have your device in their possession - and be able to unlock it - then you're out of luck. This is to be expected and is by design.
It is always a good idea to follow simple practices such as:
- Do not reuse passwords amongst multiple services
- Do not use the same password for your iCloud account as for your Mac user account or iOS device passcode
- Use a strong passphrase for your Mac user account - especially if you have your iCloud account password stored in a Keychain in your Mac
- Enable Find My on compatible devices and ensure that you mark them as missing/stolen as soon as you know that has happened
- Always keep devices updated with security-related software upgrades
In addition to these practices, it is worth knowing that modern devices usually have the best security. I.e. an 2021 Apple Silicon MacBook Pro will have better security than a 2012 Intel MacBook Pro. Similarly an iPhone 13 Pro will have better security than an iPhone 5S.