I have taken a different approach. The 2FA code is (obviously) generated in the backend, not in the app itself. So I modified the backend code so that the test account always gets the same 2FA code. That code is listed in the "testing details" field.
Once Apple is done testing, that test account is going to be disabled altogether, so it's not really a security risk.