Authy has the same core issues because the problem is they have to store the secret key in plain text somewhere for TOTP to work. Worse: it is closed source and

Authy has the same core issues because the problem is they have to store the secret key in plain text somewhere for TOTP to work. Worse: it is closed source and does not allow itself to be easily audited so we don't even get to know for sure where the key is stored and how beyond what the docs promise. Security is hard enough when everything is open source. Closing foundational security tools so only a select few biased individuals can deem them secure on a deadline is never a good plan.