So, what's their recovery method when your device with the code-generating app breaks? Do they let you register multiple devices, perhaps? Or choose multiple 2FA methods?
This is usually the weakness of large corporations that say "use 2FA" and a major reason why I don't use it on some of them (particularly Facebook, who are notoriously hard to contact if you get locked out of your account). Is BA showing any signs of considering this?