It's very common. In my experience when I was dating probably 30-40% of women did.

I think the risk tradeoffs are worth while. I keep my 2FA token generator on my phone, and the inconvenience of losing that is massive.