It's fine security practice. If the login is from a different IP/location, require the token again.

The only situation that wouldn't help against is if the actual computer is compromised, but that is not the something 2FA is meant to protect against. If the system is compromised, you should assume the account that was played on it is compromised anyway.