> If they have my authenticator app then they've already totally owned me anyway.

Seems like that is the problem they're trying to improve by using 3FA instead of 2FA.