The entire point of secondary authentication is to have a SEPARATE device that is used to verify your account.
If your PC is compromised by malware your Auth would be too if it was on there.
That is why good secondary authentication uses a physical device token or a separate device like a phone.