> So if your Twitter password happens to be the same as your ATT password, you're out of luck.

Why would you have both passwords be the same? That makes no sense. All passwords should be different.

> I only use two factor authentication if I can add it to my Authenticator app and save the code/QR code somewhere offline. Everything else is just too complex to be secure.

TOTP based two-factor auth (e.g. Google Authenticator) is my preferred method as well though I'll still set up an alternative method if it's not available. For example Namecheap offers 2FA via SMS. While not preferred, it's better than nothing.