Does iCloud Two-factor authentication send a code to the same device as a log in request?

My Apple-ID (e.g., on https://appleid.apple.com/ ) is set up to require entry of a 6-digit code sent to my registered Apple products. This code is being sent to the **same** device I'm currently requesting to log in. I feel this absolutely defeats the purpose of this 2-Factor Authentication: If a person knows my password, this person can receive the code on that device, and access my apple account without any problems. Is this a bug or can I set up / change how this security step works?