Would adding two factor authentication to an application increase the attack surface of this application?
I think it would, since by adding complexity the likelihood of a vulnerability in my application is increased and so it opens another path for the attacker to exploit the system.
Would this be right?
To directly answer the question; it depends on the implementation and/or use-case.
It's not as simple as "more functionality equals greater risk". 2-Factor authentication only ensures that there are at least two channels used as intended and thereby prove that the authentication claim is more than likely correct.
This defeats most of attacks made possible by eavesdropping on a transmission between parties. Assuming the implementation is secure, 2FA tremendously increases security (and to some extent authorization). However, assuming things is always a bad idea, especially in the case of information security.
Two factor authentication is a great way to help prevent unauthorized access especially if you use a product that's already been in development and had time to mature. Should you choose to roll your own 2-factor from scratch you expose yourself to many risks thus widening you attack surface. When looking for a provider I would look at something like RSA's SecurID which is a excellent implementation of 2-factor.
