I would like to add that if your authenticator gets bypassed then it is far more difficult to prove that you have been hacked.