In my blog Your Pa$$word doesn't matter, I laid out the key password vulnerabilities, and in response to a gazillion “but other creds can be compromised, too” DMs and emails, I wrote All our creds ar...
Updated Nov 10, 2020
Version 1.0
Blog Post
I currently use SMS-based MFA, and understand its problems, which you've laid out well.
But what scares me about using the Authenticator app is that a large number of my users are, well... inattentive, to put it charitably, and would be highly likely to approve any authentication request they got without giving any further thought to whether it was legit. Too many of them seem to have a genetic predisposition to clicking things like "Yes", "Allow" without understanding (or even bothering to read) what they're clicking on.
At least with SMS, if a fraudulent logon attempt generates an OTP, the user can't funnel that back to bad guy, and that's why I'm sticking with SMS for now.