I suppose this is a good example of where Azure MFA can be useful. Rather than having an app generate a code, it can be configured to call your phone instead. I hadn't really cared for this option, but as long as your phone can receive calls, you can still authenticate, so it protects against this sort of situation.