Lastpass and it seems to work well. Have it generate a strong 12 character password with uppercase, lowercase, special characters and numbers (depending on the restrictions of the application). Secure it with a strong master password and change the master password on a regular basis.
That said, if someone guesses your master password, then you are in trouble.
If you are using your phone for the "something you have" factor in 2FA, you should probably have the device secured with a password, pin, etc. That said, you make a good point, if someone has your phone, it's not locked down, and google (or whoever) remembers your password on your phone, then you are screwed.
People use phones for the second factor because they are convenient and always with them. I think the solution to the problem you stated above is to use "something you are" (thumprint biometrics) as the second factor of authentication instead of "something you have" (SMS code/mobile authenticator).
In the next couple years, most high-end smartphones will probably have thumbprint scanning technology, this seems like a better solution (and more convenient) as you only have to scan your thumb and it'll work as long as you have data, you don't need to worry if you have good cell reception (for SMS).
In most cases you can remotely wipe the compromised device but it will take some small amount of time to do so. You can also de-authorize the device in your password manager, etc.
This is, I think the point of the article. While it may rationally make sense to use a solution like this, many users may flat out reject it.