While I agree that Twitter's mechanism addresses the vast majority of potential attacks against a person's Twitter account (which would almost always be remote), it's not hard to imagine a scenario like Authy describes.

Imagine you're at work, logging in to a two-factor system. Now imagine your attacker is sitting 15 feet away from you. All the attacker needs to do is wait for you to attempt to login to the system before attempting to login himself.

When we have penetration tests run against us, this is exactly what is happening. We give the penetration tester a desk, a connection to the internal corporate network, and the same bare level of access we would give to a temporary contract employee.