Since I don't allow anyone to install stuff on my personal phone - and they probably wouldn't want to store their secure data onto a device that I rooted anyway - then the only option is for the employer to provide a 2FA device.

It doesn't have to be a phone, though. Yubikey is good and affordable.