I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for p

I mean, I think it's a lot less likely that someone compromises my printer which is behind all of the same network protection measures as my PC, scours it for previous printouts of QR codes (if it does retain them), to identify what account they can potentially hack... than that they compromise a 2FA cloud service directly and log into all my accounts. What's the threat model here? If the CIA is in my home network, I'm sure they can get into my email account too.