Truth in advertising: Two Factor Auth gives you two-factor authentication. It's dead simple -- install the plugin, scan the QR code, make it secure.
Yes, with shell access to your system, you can delete the plugin. A compromised administrator account could likely disable the plugin as well, but that is not unique to this plugin, or to anything else on your site.
If your admins all can use OATH -- or if you're the only one -- this is all you need.