Restoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption g

Restoration of the 2fa codes onto a new device doesn't seem to require communication with the original device, so I don't think there's client-side encryption going on. The Authenticator also has password vaulting features, but I agree that would be a bad idea for both your 2fa codes and your passwords to be in the same place (even worse if you use Outlook!)