The secret is literally transferred when you first set it up encoded in plaintext in a QR code, and then again, as I expect most here use a service like Authy.

The secret is literally transferred when you first set it up encoded in plaintext in a QR code, and then again, as I expect most here use a service like Authy. Unless you're using a device that already implements true 2FA like a Yubikey, it is generally trivial to pull out the seed (e.g., Google Authenticator app).