It seems that Valve actually accepts not one but several tokens generated close to the point of request being sent, so our 2FA code will be always valid for 1-2 more minutes after supposed timeout...
Thanks to that, we can guarantee some room for networking, but also make users more happy as they'll never get 2FA tokens no human is capable of entering in time
The general problem is a mix of a few things: The fact that we don't have much time before steam network disconnects us, if we connect to it and not send log in request in acceptable time, the fact that Steam API might be unavailable and not provide us with server time, and the fact that we must know that time to generate valid tokens.
Previous solution would simply generate token immediately without asking Steam API, and schedule update in background for later, so even if we had incorrect time and failure of first try, second try would usually come with the right clock. If not, eventually we'd succeed anyway.
However, it's possible to slightly improve that - we can generate 2FA code BEFORE even connecting to steam network, this way we have time to ask Steam API, and in worst case of API timeout we'll simply try with our own clock anyway, and if it succeeds, timeframe before connecting and sending logon request should be small enough to fit - in worst case of being on the edge of 30 seconds, we'll simply try again later.
Perhaps it'd also make sense to modify slightly MobileAuthenticator to block and wait in case code is expiring in less than 5 seconds, that could be cool too!