A password is something you know, and anyone who learns it becomes you. A second factor adds something you have — a phone, an app or a key — so a leaked password on its own no longer opens the account.
The methods are not equal. Codes sent by text are better than nothing but can be intercepted by moving a phone number to another card. An authenticator app generates codes on the device itself, and a physical key is stronger still because it verifies the site as well as the user.
The practical risk is losing access. If the second factor lives only on a phone that is lost or wiped, the account can become unreachable, which is exactly why every service offers backup codes at setup.
Codes failing repeatedly usually means the device clock has drifted. Authenticator codes are generated from the current time, so a phone a minute out of step produces codes the server has already expired.