Ask HN: Have I found a big flaw in iCloud two factor authentication?

I just set up two factor authentication. The only trusted device I have is an iPhone. I signed into the iCloud website on my laptop to test it out, and the two factor code SMS then appeared right on my messages app on the laptop itself. This seems to defeat the purpose.

I have Yosemite/iOS 8's new SMS forwarding set up so I can text my Android-owning friends from my laptop. I suspect this is the culprit.

The solution would be using some Authenticator app on the iPhone itself, but without that, it seems like 2FA isn't safe if you're using SMS forwarding with the new versions of Apple's OS's.

Am I missing something obvious?

Thanks