SMS 2fac isn't any better in this regard, since you typically receive the SMS on the same device that stores your passwords.