Actually, here it is a SMS if using a new device. I had one SMS when I first used the app password, basically asking if it was me logging in.
confirm this is my case as well. Received a phone SMS only once on my phone number at the registration moment to confirm the user identity, after that I could simply login by SM mail everytime with the application password (needless to digit, it is stored) , nothing else.
So the whole action is for google to receive your current phone number (SMS). Where is the so called 'security improvement' if afterwards you log in via simple password then before?
Well, if someone acquires your Google password, they can't download all your mail without your phone number. Not much of an improvement but still an improvement.
Using OAth 2.0 gives about the same level of security. A lot of it seems like security theatre, "hey we're doing something about making things more secure"