But $vendor, which supplies $application, doesn’t give a flying fuck about this. I’ve seen binaries in /etc/opt/$application or something like that.

Hard disagree. I do not want to have 2FA for every shittly little thing I do not care about.

QR codes are just an encoding. Just use any half-competent QR code app, and it will give you it’s content, which you can then write down. For the reverse you can use any QR code generator.