> The fact that this is still possible on desktops (though not everywhere anymore, e.g. my bank requires you to use a phone app for authentication) is for historical reasons.

And you think that this is fine? I will fight for my rights for one.