I just removed and re-added my google account to my android phone. I was surprised that in order to add the account, I had to supply my normal password, and a TOTP from google authenticator. It was not an option to use an app-specific password. Since google authenticator was installed on the phone in question, it does not seem to be an appropriate method for 2FA. Of course, a potential attacker would still require access to the phone AND my password, so there are still two factors of authentication, just not how I expected it.
Is my understanding correct, that an app-specific password would be more secure? If so, it doesn't seem right to me that allowing a single app to access part of my account is more secure than full account access.
Is it possible to change a setting to require "add account" on an android device to use an app-specific password, or at least to use a TOTP from a different device?
There is a similar question on the android stack exchange site. Is it appropriate to repeat the question here to get a security perspective on the question? I would also be open to suggestions for a google forum where I could post this question (I found two which gave me error 554).