Well, I hate to break this to you, but Google Authenticator plus password isn't really two-factor authentication. Proper 2FA is two separate items out of traditionally the triad "something you have" (physical item, which may itself hold a secret), "something you know" (secret), and "something you are" (often biometrics).
Password plus Google Authenticator is probably better summed up as password and soft token, as Troy Hunt did in a recent blog post. Basically, the app stores a secret, and uses that secret to generate temporary passwords.
If someone is able to break into your
phone general-purpose pocket computer with a variety of radio interfaces running arbitrary, potentially hostile, software, they could presumably find some way to extract those secrets. Once extracted, they could likely be transplanted onto a different phone, which would now generate the same temporary passwords.
This doesn't mean that a "soft" 2FA is meaningless. It does raise the bar considerably for an attacker. But it's still a variation on "something you know"; only that the knowing part is done by your phone, rather than by your brain (or, hopefully, password manager).
To make a claim that something is "flawless" means that there must be, at a minimum, no conceivable way by which it could be exploited by an attacker. This seems a rather high bar to meet for a general-purpose computer running arbitrary software storing a high-value secret.
Better to just stick to saying that it makes an attacker's job more difficult.