Proper implementations of TOTP do not just rely on expiring the codes. From chapter 5.2 of RFC 6238: "Note that a prover may send the same OTP inside a given time-step window multiple times to a verifier. The verifier MUST NOT accept the second attempt of the OTP after the successful validation has been issued for the first OTP, which ensures one-time only use of an OTP."
If it accepted the same token more than once, it couldn't possibly be called a "one-time password".
Oh wait, what was this article talking about again?
That said, Authy is pretty convenient for most users as far as backups are concerned, and I'd imagine its at least as secure as storing the database in iCloud/Google Drive. They at least do ensure two factors (albeit a soon-to-be deprecated SMS factor) to get the raw data.
For my phone, at least, I can get a program that does all the rooting for me with a click.
Sure Google allows you to port authenticator data with an easy 5-step process. Almost nobody else does even this.
Without portability, it means losing access to your Facebook, Instagram and Pokemon Go when you change your device? People would revolt if you do that.
So what's the alternative? We either use SMS, or we use email (which will have like order of magnitude higher failure rate with no added security) or we don't use 2FA at all. Or we think really hard and invent better 2FA than SMS that works on every mobile device and is simple for the user. Then we can deprecate SMS.