The 2FA apps on the phone (like authify and google authenticator) use a shared secret between the server and phone, plus the time, to generate the code. (This is the alphanumeric or qr code you set up with)

If someone can remotely root your phone, they can remotely retrieve your shared secret, and thus generate your authentication tokens.