For good implementations, it's not a naive token saved to the hard drive but a key saved to the enclave that's initialized during first auth. To crack that you need to get sufficiently advanced malware onto the device so that it can break open the enclave.
These both are significantly more secure than a password than anyone can spray against the target from anywhere and are subject to reuse.
Of course too many lusers use IT devices even for serious work but consider their "luser" characteristic as a natural fact and instead of education prefer trusting a vendor for me is like preferring a dictatorship hoping that "it will be a good one" because people are not adult enough to be in a democracy.
A small classic example we all know "ok, you are authenticated because you have entered the correct username & password, now prove it a bit more typing an OTP I send to your mobile via SMS" can be easily read as: "I do not trust enough you because someone may have steal user & password BUT I consider enough unlikely that he/she/it steal also your mobile" and as a consequence it means that carriers/phones are considered more trusted than humans being. Not a good thing for me, not a thing I can accept despite, in limited case have some points.
Also I do not want my carrier know all the service I use and when I use them, it's a significant metadata leak that may be irrelevant in single case but may became relevant in other cases.
Try to think of a Plan9-like world, which means user-centered not "modern mainframe centered". We still need services, but there is no need to have them like today.
And inflammatory comments aside, yes, any good IT org should believe that it's more likely for a user to be phished and give away their super secure xkcd based password than it is for a nation-state attacker to target their phone OS with a 0day.
After think about ancient Plan9 model which put your personal workstation at the center of the world and "services" only as "addition" to it. In this scenario need of auth, risk of phishing etc substantially vanish.
They are likely already there. Ever had to provide fingerprints for an employment background check or security clearance? They have likely been leaked, along with all your other personal history.
The goal is that an attacker has to steal your physical device and get access to your biometrics, which is significantly more work than spraying aardvark to zebra against an ROPC endpoint.
I hate seeing XKCD style passwords being advocated like this all the time. If I know your password is “four English words”, it’s pretty much game over. While there are well over 100,000+ English words, the average English speaking person would draw from a list of about 5,000. 5,000^4 is only 625 trillion combinations. With GPU based password cracking easily topping 150B/sec these days (depending on algo), you can see how this isn’t as secure as you’d otherwise think.
n-th factor auth: how can we trust a token? I mean at a hardware level? => if we can really control it's a nice ADDITION to password protection, but no more.
Other options like "granted third parties" (SSO solution by any kind, from Google to mobile phone auth) IMVHO can be trusted LESS than passwords. So in the end we only need to teach XKcd password strength vignette and teach developer how to care about security.