You can now add a second step to signing in, from Security in your dashboard. It means somebody who has your password still cannot get into your account. It is off unless you turn it on, and turning it off again never needs anyone’s permission but yours.
You pick the methods, and the order. Choose any of an authenticator app, your fingerprint or face, a physical security key, or a code by text — and turn off the ones you do not want offered. Whichever you put first is the one you are asked for first; the rest are there as a fallback. If you only want an authenticator app, that is the only thing you will be shown.
Recovery codes are always included and cannot be switched off. Losing your phone should not mean losing your account, so you will always be offered codes to save or print.
Turning a method off changes what you are offered when setting one up — it never stops you using something you have already set up, so you cannot accidentally lock yourself out from this screen. To stop using one for good, remove it from the same page.
A passkey remains the quickest and safest option and still works on its own. If you already use one, you are covered.