My super fund uses 2FA but it's only by sending a code to email or phone. It would be much better if the use of an authenticator app was required (actually "available" would be a good first step).