The reasons why the authenticator cannot generate Application Specific passwords and why it does not need a PIN lock are the same: the entire point of 2-factor authentication is that the authenticator by itself is not enough to gain access to your account. You must separately provide both a code from the authenticator and your real password every time you log in.

There's no such thing as a "one time password". There are "Application Specific passwords" which work exactly like your regular password except that they limit access to critical account settings and can be created/disabled at will. If someone obtains one of your Application Specific passwords then they can use it to log in and access your data until you revoke that password but they cannot change your real password and deny you access to your own account.