Apple already kind-of supports this for iClout login. If you want to authenticate on a new device, you’ll get a prompt on one of your already authenticated devices to confirm the login. You still need the password, but it’s really not necessary... if there was also some additional “privilege” system (i.e. that the same user account would have less privileges if logged in through a less secure method) it would be even safer.