Google Authenticator is absolutely fine. You can protect access with FaceID. Backups should be offline backups anyway so the best practice would be to write down new 2FA codes on paper.

Additionally, you can export a QR Code combining up to 10 records (which can only be read by Google Authenticator though)

I don’t know any of the apps but the smaller the company behind them is, the larger the risk of a malicious actor. Please be reminded that „it’s open source“ is only a valid argument if you compile the app from this source code yourself.
It is known that’s Googles business model is not „steal 2FA codes and sell them“. So I have zero trust issues with them.