Much better than SMS, but not as good as a security key, because if you can fool someone into logging in to an impostor site, you can get their email account.

Much better than SMS, but not as good as a security key, because if you can fool someone into logging in to an impostor site, you can get their email account. It would be a reasonable backup in place of (or in addition to) Google Authenticator.