Oh no, the string and/or QR code should be backed up when one is setting up the 2FA. If you have that seed phrase, & any device with correct time can calculate

Oh no, the string and/or QR code should be backed up when one is setting up the 2FA. If you have that seed phrase, & any device with correct time can calculate the TOTP code, even a simple local javascript app. Obviously that phrase leaked would mean hacker can also generate codes. So that's why those phrases should be kept extra safe, away from normal passwords.