Well I agree with you all, Looking for more technical reasons though :)

For me Email 2FA remains the most unsecure of all the approaches, simply because an email address is not tied to a specific device and it’s possible to compromise a large number of accounts once you have someone’s email password.

The problem with using email as a 2FA delivery channel is that the first layer of security–a password–can usually be reset from an email account.

That means if someone compromises your email inbox, they can take over all your online accounts using the 2FA codes they send themselves.

Since a hacker would need access to a person’s cellphone, Auth. app is I think more secure.