There’s a middle ground with an out-of-band shared decrypt. Authy has the most user friendly TOTP sync that lives on device, but are other more open source ways to have your cake and eat it too in this regard.