Magic links improve security on a couple of fronts. For one, they prevent users from making weak passwords, which let's face it, most people likely fall into this category. One could argue that strong password requirements do the same, but in reality they compel many users to reuse the same "strong" password, weakening security overall. Magic links prevent this entirely. Secondly, they protect users from weak auth implementations, leaked password hashes, passwords stolen through brute force attacks, etc. Because there are no passwords.

I don't have much of a security argument against magic links. I suppose an attacker that gets access to your email now automatically has access to the application. But frankly that is true for passworded apps as well, given the "forgot my password" workflows out there.

Completely agree with that

Agree. I want to hear the same about magic links. The thread you linked about does not talk in context of an "average user". Security choices we make in context of an average-user vs power-user can be a lot different.