Basically 2FA relies on the idea that instead of just something you know, using a service also requires something you own.
I am quite confident, especially when used on iOS (which has a better system level app segregation), that this gives a pretty good security. Though I am not sure about adding a desktop 2FA utility.
In my understanding, an attacker would need to intercept my password (likely through a keylogger on my desktop machine were I log most) and an access to my phone, or to the key stored on my phone. But I can likely picture that someone able to setup a keylogger could steal enough information to reuse any 2FA system available on my desktop computer.
Writing this I am understanding that this is based on the perception that:
Computer integrity < Phone integrity < iOS integrity
Computer are more likely to be corrupted through the pile of junk I am installing on it and their more important "openness" to system changes.
Smartphones have a more restrictive ecosystem and a shorter livespan, thus a lighter probability to be infected.
iOS, is comparatively the most closed ecosystem where unlike on Android most access are not opened in API and the app checking is more thorough.