What about if a person is using the code generator? The password can be changed, but there’s still the 2nd level of authentication. Can the 2nd level be brute-forced? Can it be fast enough to brute-force the authentication code before a new one is generated?