I had the same question as you and the only thing I could think of was that our phones can be hacked too. It's a publicly facing device as well and has multiple vectors for attack vs. a standard dedicated 2F auth device.