That's wahat I did for a while, but I heard Aegis takes security more seriously than AndOTP, so I use that now (both are available on F-droid).

AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone.

I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)