Comment by MetroWind

Honestly I don't care about any of that. From my perspective, passkey = phone + app required. That's already a red flag big enough for me to not use them. If I put on my engineer hat, another problem I see is that most services seem to not be competent enough to implement it in a non-broken way.