[cube2222]

That's technically not two factor if you only need to know a password to get access to the one-time code.

It's two passwords, both are something you have to know, there's nothing you need to have or be (sms and biometrics respectively)

[romwell]

Your comment highlights why phone-based 2FA is not a 2FA.

[cube2222]

It is, you need to have the phone.

But if you can access the phone content remotely behind a password, then it stops being 2FA.