[Cthulhu_]

Mobile phones can be hacked; if you use your Authenticator app to log into an application on your mobile phone, it's by definition no longer two-factor authentication. The basis of that is having a separate device. Having that in a key that cannot be compromised by e.g. being rootable, internet connected, etcetera is an extra layer of security.

The mobile phone is more convenient though, and I also don't know how these things work when you try and log in via a mobile device. For high security access though, like google cloud consoles and such, a policy of not allowing access via mobile phones does make sense. (also because said console is probably not very usable on mobile).