In reply to a tweet by me:
This is key. Until the user chooses to autofill the code, the app or website has nothing. When you do choose to fill in the code, the app or website only gets the one code. On other platforms/engines AIUI, the corresponding feature grants SMS acces.