Hardware wallets are fine but make sure the one you pick is (at least mostly) open source and hasn't had any vulns in the update you're running.

As of Google Auth...
The app Google has isn't the best. First of all it keeps no backups and has no password to get inside it. I would recommend you try and download an open-source equivalent from the FOSS android marketplace, "f-droid".  Go there and download andOTP. It makes it easy for you to migrate to a new device without having to go to every service to change 2fa, and also has a password to enter.

The latest feature is especially important because android OS password are especially focused on and oftentimes there are discovered ways to bypass them or crack them. So you shouldn't rely on that measure alone if your phone gets stolen.