But except for some dinosaurs insisting on SMS (which you can receive on a dumb-as-bricks phone), you can absolutely have 2FA without a smartphone. Most password managers handle it, with the bonus points of checking the domain when entering the TOTP. If you want separate baskets for your eggs, you can use dedicated TOTP apps (Authy works fine for my needs). You can even roll your own. You can use an external token like a YubiKey.

I may be missing something, but I have a really hard time understanding the "corporate backdoor / overwatch / control" argument when it comes to MFA.