To use the code sent to the phone, you need to know the password or the recovery key as well. That's the two factor part.

Contrast to someone getting your phone today... they can easily determine your iCloud account name in Settings, and then send a password reset for it that is delivered to the unprotected Mail app.

So for most people, it's certainly more secure.