LineageOS users can enable Privacy Guard to protect google authenticator, which requires device credentials (pattern, finger etc.) to start app. Also don't put it on your homescreen