[x0x0]

Since there's only 3 or so (google, microsoft authenticator, okta, anyone else?) apps in widespread use, that seems not actually like an obstacle?

[goatsi]

They also need to know where in the app the code for each service is displayed, so they are grabbing the code for your bank and not for your World of Warcraft account.

[x0x0]

which they can read from the same fixed layout/offsets displaying it to you

[efreak]

I assume Authy is fairly high use. I use Aegis usually, but I likely it has very little usage share.