It's not that it must be registered (incorporated) in Germany. It's that for tax purposes if the company is run from Germany it will be considered "permanently established" and treated as resident there. Permanent establishment laws are often quite surprising to people doing business across different territories.
> If I've got a long, random, unique, securely-stored password, I don't actually care about having a second factor
I'm not comfortable with my entire online identity being protected by a single line of defence which is a company that I'm paying a few dollars a month to. Not having to type 6 digits off a phone is a pretty minor convenience for me.