2-factor has a lot of forms, from trusted third party (authy, duo security, etc) to non-networked app (OATH implementations like google authenticator) to smartcards as part of a PKI, to dedicated hardware tokens (RSA/EMC tokens).

They do not suck. Which one is best for a particular need depends on the service and the user.

Toopher's location awareness looks like an incremental improvement on services like Duo. However, it still depends on a third party (Toopher) in addition to the Toopher-enabled website and the user, and it additionally depends on the device having internet connectivity and having location information (GPS, or rough location from cell towers). Some applications cannot rely on a third party; they only want to require trust in the application servers themselves and the user's device, and not trust of third parties (Duo, Authy, Toopher) or network access (internet, SMS). In those cases you need a OATH app like google authenticator, or a hardware token, or, if you don't want to support mobile access, perhaps smartcards as part of a PKI.

The problem with hardware tokens, which are arguably the most secure, is that they don't scale well: you need one per application, and the marginal cost for each one is not trivial. That's fine if you only need one to access your employer's VPN; the employer decides the cost is worth while, and one thing on your keychain is not a big deal. If you need another one for your bank, another for your primary investment account, another for your employer-sponsored IRA, another for AWS, and on and on, pretty soon you need a man-purse to carry them all, and the services that offer them have to absorb the hardware costs somehow. Either the risk mitigation has to make the costs worth it, or else the service will pass on the costs to you, the customer, in some way.

the price is quite a bit higher than much more secure and far reaching technology from companies like secureauth?