Another user here pointed out that Authy uses a user provided password to encrypt the 2fa secrets on the server. That's definitely more secure than I had said,

Another user here pointed out that Authy uses a user provided password to encrypt the 2fa secrets on the server. That's definitely more secure than I had said, that's my mistake. (I still have my reservations, but that's getting too pedantic to matter here)