OP stated that getting access to the phone would have allowed a hacker to compromise the protected systems. A 2FA credential alone shouldn't allow that, so my assumption was that they were storing a full authenticator on the phone.