I've been trying out Authy, a Google Authenticator alternative with an optional feature of being able to back up your tokens. They have two types of tokens: Authy-generated tokens and the regular OTP tokens you added by scanning a QR code (like you would in Google Authenticator).
If I understand correctly, backups of your standard OTP tokens are encrypted with a password before uploading them to Authy. Your backup password isn't sent to their servers, they just store an encrypted blob of data for you. Sounds good so far.
However, when setting up Authy on a new device I noticed that the Authy-generated tokens don't seem to benefit from the same level of security. When you set up Authy on a new computer you can get access to your account through SMS verification (something they've criticized for being insecure). Entering an SMS passcode will log you in and give you immediate access to your Authy-generated tokens (assuming you've enabled multidevice support). The Authenticator tokens are still encrypted at this point, and they can be decrypted if you enter the backup password.
What are the security implications of this? Doesn't the SMS-based login procedure make Authy-generated tokens quite vulnerable to capture?