The author missed the obvious and common attack scenario where an attacker gains access to an email account associated with a vendor account, uses the email acc

The author missed the obvious and common attack scenario where an attacker gains access to an email account associated with a vendor account, uses the email account to reset the vendor password, and logs in. Two factor effectively prevents this attack. Third parties (like Google Authenticator) possessing the 2FA codes is not a problem because they don't possess the passwords and are generally "trustworthy." Losing access to the 2FA hardware isn't such a problem on platforms like Heroku that assign account recovery codes. Just PGP encrypt them and call it a day. 2FA is a valuable last line of defense against a targeted attack.