When setting up an online account, the service will prompt you to use an authenticator app. This will be required when you log in from an unknown device, or if you hadn’t log in for a month. The authenticator app will provide a 6 digit passcode that will be required in addition to your user ID and password. This means that even if someone was to get your credentials, they will also need your phone to log in. And with many authenticator apps requiring a password, or biometric login, this will make it much harder even if the would be thief had your phone.
In the event that your device is lost, you would be able to receive a passcode sent to your email address. This obviously means that your email will need to be secured, and this is an option in addition to using your app.