We don't generally make it possible to disable 2FA handlers but in the case of this handler, removing the API keys should disable it and that doesn't currently appear to be possible.
Thank you for reporting this issue. The issue is now resolved and we are aiming to include that in a future XF release (2.1.0 Beta 3).
Change log:
Remove the option verification code that prevents the Authy 2FA handler from having its API key removed. Further make sure that Authy can only be used if the API key is configured.