It's a second factor anyways. If the provider is fully compromised it doesn't matter much if the attacker can get the secret. If the secret leaks the password is hopefully hashed so attackers still can't get in.

I'd much rather have a reliable method of 2FA that works offline, on all of my devices and can only be hijacked from me or the service than use one that requires my phone to be nearby, working and having service and can also be hijacked by my phone company.