You need an already logged-in device or a printout of the secret key to login. The former isn't much of a concern because if an attacker has access to a logged-in device, you're screwed anyways. The latter would require physical access to your home, and the same applies here too.