Can't reply to mryan, but I'd just checked this before coming back to HN & indeed, google-authenticator doesn't make any network connections when invoked & it generates the QR-code locally.

So don't hit that URL if you don't want Google to know your 2-factor auth data!