With every platform, there is compromise between convenience and security; when your platform has to reach many, many non-tech-y people, convenience is preferred.
There are easy trade-offs one can make between convenience and security. For example, identity verification on the phone with the last four digits of a credit card (Apple).
But then there are policies and technology that increase BOTH convenience and security. Say the difference between using SSH these days versus using, say, paper and an Enigma machine.
The inconvenience of Google Authenticator is minimal and the security provided is huge.
