From then on I started moving my company's team and contractors (as well as family and friends) off …

That sounded scary, but after reading into the Retool breach (thanks for pointing it out), it doesn't sound like Google Authenticator is completely to blame. Retool points out the "attacker was able to navigate through multiple layers of security" [0], i.e.: 1. "through a SMS-based phishing attack" on "Several employees" 2. "one employee logged into the [SMS phishing] link", "logging into the fake portal" 3. "attacker called the [phished] employee" "and deepfaked our [IT team] employee’s actual voice" 4. "the [phished] employee grew more and more suspicious, but unfortunately did provide the attacker one ... (MFA) code" (over the call) 5. "The additional OTP token shared over the call was critical, because it allowed the attacker to add their own personal device to the employee’s Okta account, which allowed them to produce their own Okta MFA from that point forward." 6. "This enabled the…

> I started moving my company's team and contractors (as well as family and friends) ... onto Aegis An important question on this, if you don't mind: If the phone, where Aegis was installed, is dead/lost/stolen, which options are available to make sure that access to the accounts linked to that phone wouldn't be lost either?

Point of order: Retool got hit by an SMS phishing attack, and while they made a big deal out of Google syncing TOTP seeds, the real moral of their story is to stop using TOTP altogether; it's not phishing-resistant. Rather than cutting a whole team from one TOTP app to another, it would probably be a better idea to shift the whole team to an IdP that forces FIDO2. TOTP is obsolete.