[IceSt0rm]

If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed.

People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator).

In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).

[runamok]

In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.