A main problem with any extra layers of security is that it is another layer that can go wrong. Google's 2 factor auth is sometimes pathologically incapable of sending a text message to my phone. In those cases I have sent myself an sms via other routes and they get through so I must guess that it is something Google is doing wrong. Yay. So then once I do get in I try to get some backup codes and save them, but the UX for that is weird and really bad and hateful as well. So all in all, a fuster cluck when it comes to user experience.