This change is really more about enterprise use cases. If you take DLP seriously you need to make sure the integrity of the controls on work provided devices are intact. Authenticator isn’t managed by intune since users could use it for many things.

Nothing stops someone taking a photo of another screen. It’s not a panacea. It’s just one more hurdle.