This is indeed an issue and I urge everyone to heed this advice!
I currently have a friend that has had this exact issue cause him to be locked out of an account that he set up 3 years ago, where he'd invested in a BTC mining company that currently has untold value in it, likely $1,000s. He's handed me 2 old phones with no batteries that maybe were used to set up the Google Authenticator as our only hope at this point of ever recovering those funds...
I hope you are able to recover those codes for your friend, that's a good deal of money to lose..