> Worse, the security policies seemed to be fundamentally flawed, because they kept insisting on some form of authentication based on a trusted device when the purpose of the transaction was to notify them that the trusted device had been stolen.

Are you suggesting any random person without any authentication proof to be able to just sign people out of their devices ? That would be a broken security.