Yeah, I find it so strange that the Google Authenticator setup includes a step to download a recommended 3rd-party scanner scanner, given that GA is pretty much the most important app security-wise you can install on the phone.