All MFA codes are shown when accessing the application instead of being hidden and only the chosen one is shown. The app is not password protected. The export functionality only works by scanning QR codes from current phone, which isn't useful if the phone is lost or stolen. It should produce some type of file to be stored somewhere secure and then imported if needed.