How would it know it wasn't your current device? They'd have to leak some special data via Safari. Furthermore, does it matter? There's a fair chunk of users who only have one Apple device, capable of producing those codes, anyway. If the attacker already has an unlocked phone from the user, chances are they're already pwned anyway..

2FA prevents people who successfully phished you (e.g., they managed to send you an email that opened a fake Google login page that you put your password into) from logging in with your username and password without being in your physical vicinity.

2FA popping up on your personal device that you authorized, even when that's the same device you're trying to log in on, doesn't reduce the security of that.

And would have to know your password.