Yes, it's not the part of having the code on your computer I'm contesting. It would be risky to do so -
all the eggs in one basket.
I just don't see how keeping a password in such a method (authenticator/phone/etc.) creates a significantly positive difference in safety as opposed to those storing/entering it sensibly not using another device.
In the requirement of two independent factors for authentication to have access to a battle.net account, one must have:
1. The email address
and
2. The password
The email address is likely on a lower security level than the password, but supposing it's not, the password alone does you no good. However, it's not that unreasonable to think someone who really wanted to access a specific other's account could discover that person's email address - either through 1. third-party internet sites which use it (like this forum for many), 2.
charactername@gmail.com, or 3. physical devices containing trace evidence, such as that person's computer or phone.
1. Unless the email is created only for the purpose of the battle.net account, other parties will have access to the information, so it's not secure from independent parties.
2. If the address is something to this effect for the account, there's a decent chance someone wanting access and knowing the person will hit it by trial and error.
3. Parties having access to these devices have a good chance of discovering the email address on them.
In the first two cases, the security risk is dependent on how conservative one chooses to be with their information online. In the third case, the access is more or less restricted to a physical breach of security.
If one is sensible about passwords, cases 1 & 2 should not apply to them - don't use the same password everywhere, and don't make it something people would guess - an alphanumeric code, shifting of cases, and arcane wording (if words are used at all) can reduce the guess chance to about zilch.
However, the third case may still apply.
Suppose one puts the password - or the coding to generate the password - on one's phone. Another person accessing this phone now has a very reasonable chance to obtain both the email address and password necessary if they were looking for them - account breached.
All the eggs in one basket.
This scenario is the same category of risk one takes by keeping tangential evidence of both email and password on the computer. The advantage of keeping it on the computer, however, is while you need the computer to play WoW, you
don't need the authenticator (phone) for a password, and this obviation makes one less component necessary for you to use the game. Suppose you'd lost your authenticator. You can't log in now, and you get to go down the yellow brick road of customer service. More convenient not to mess with it.
But less secure? Maybe, maybe not. Since there's a legitimate chance the password and email could be both traced to one's computer (via keylogger) OR to one's phone (not both as that creates unnecessary risk), either option tosses all the eggs in one basket. It's just deciding which basket to pick.
---
Add.:
Personally, I log-in with two buttons (after I start WoW). One button enters my email address and tabs to the password box. The other types the password and presses enter. It's very easy for me as I have a keyboard with plenty of programmable keys, taking a fraction of a second due to finger memory, but a similar keylogger circumvention can be accomplished with copy + paste. In the nearly 6 years I've had the game, I have never been hacked. I changed my password once. While just a single case, I can say the dozen people or so I know whom use similar entry methods to accounts had no problems in the time they've been using them.