Backup codes and use of Authy (running on phone and desktop), instead of Google Authenticator, can help in such situations.
It prevents from someone, somewhere, having your password but not your 2nd factor.
It's incorrect to take these measures as giving perfect security. They're efforts to greatly increase the cost for attackers. It's a pretty good improvement to increase effort from "having a password" to "having remote access to your computer."
If someone hacks your phone they have access to all your email, whether you have 2fa set up or not. If someone hacks your computer in this case then they also get access to all your email.
The thing that 2fa is good at is preventing hackers from logging in if they guess or find out your password. If your device is compromised then everything you do on it is vulnerable, no matter how many factors you have.
AndOTP has some support for SteamGuard (though not everything), which I can't use since I refuse any proprietary app on my phone.
I wish websites supported PAKE, Fido U2F, Webauthn, TOTP and Client certs across the board, but that's probably a pipe dream :)