FYI we discussed that consideration here. I never heard of a single person using 1P (in 2011 AgileBits said they had “100s of thousands” of users, and it’s probably millions now, considering it’s on Windows, Android and even ChromeOS now) who ever had this happen to them in the 5-6 years that 1P has integrated 2fa - have you?
Someone would also need to get into the user’s device first (and then have to get into 1P of course). Incredibly, incredibly unlikely. Besides, it would mean having to have two unique passwords to remember instead of one, and the convenience is considerably less by using the second app.