So one thing you're getting confused about is that you're combining to different security theaters. Let's instead look purely at the web, and then purely at the phone.
The Web Theater
With the web you're subject to people randomly trying to hack your account. This is protected by a password(something you know) and a username(something you have). In this case if anyone gets the username they can start attacking you and eventually get your account.
Now lets add a second password. YAY! Now they have twice the entropy. But it's still something you know(static). Instead lets change that password to something dynamic. Now EVERY time that dynamic one changes they have to start over because they have to retry every dynamic code and password combination in existence yet again.
That's just not worth it to try and break into. You would only DDOS a server, and if the server is setup correctly then you can't DDOS it.
The Phone End
Okay so now someone has your username, and phone, and you're locked up in a basement... and they've beaten you until you have given them the passwords... and you're just crying and hoping the police show up and save you...
The truth of the matter is that the given part(on your phone) is kept physically secure by you. If you have a worry about physical safety, you should probably already be in the steps of doing something about it(like not lending it out, not displaying notification content on your lock screen(an option on most smartphones), and if you do receive it over SMS and someone sees it, all they see is a string. They don't know what it's for.
If they do know what it is for however then you've already been pwned because they know your username. If someone else knows your username you're doing something else wrong, and this isn't the problem. Your own physical habits are.
What about active connection pins?
The problem is the phone is making the communication, and as such if someone is listening to the phone and performs a MITM on just the phone, they can get access to the account. Generation without communication is much safer because someone can't listen to it. They would have had to have been listening to the initial setup(again separated without communication) to have gotten the pin to generate the time sensitive code. Again that comes into the tied up in a basement scenario. There I'd be much more worried about my physical safety than my account safety.
What about generated codes?
What if I look at a phone and see '8675309 sent 98jdff712hfg' on the screen? What does it mean? I don't know what service that number(usually from a pool of numbers that rotates randomly or is used by many services) is associated with. The only way this would have made sense is if I was sitting over your shoulder and watching the ENTIRE login process. Again that's something much more terrifying and you'd probably be looking out for it as you enter the data.
