There's a whole set of fallbacks built in to the standard, including Bluetooth, local network connections, and going via a relay server. All of them eventually end up with your device signing something and handing that back to the browser on the other device to complete the authentication flow.

If you're not happy connecting your phone to the network, then how likely is it that you would you be willing to enter your login details on a machine you don't control?

Steam does this. If I want to login, it shows a barcode I can scan with the app and it logs me in without needing to enter my login information. Phone needs internet access, doesn't need to be on the same network as the device I'm logging in on.

I assume the QR code contains a token for the device, which is used by the app to authorize the login and the server automatically logs in the client on the device with the matching token.

Seems a lot safer to me than using my login credentials on a potentially unsafe device.

what good is a phone if it isn't on a network?