Yeah, sure, but then again a watch on your wrist is harder to take away than a hardware key on your physical keychain that you don't pay attention to.

EDIT: yes, lol, thank you for explaining what phishing is jgrahamc. We didn't know. I get that a lot of Americans and some Germans guard their car keys like an internal organ, but for a lot of people in the world a keychain is something you toss in an insecure place most of the time of the day.

Phishing doesn't require stealing the watch. It just requires me to type in a TOTP token on a phishing website. Very different threat model than physical access.

It may be easier to steal, but it should have some kind of minimal protection. It should lock out after a low number of failed pins, for example. The YubiKeys do this.

stealing watches is pretty trivial if you practice. but also TOTP is just more inconvenient than, say, the Microsoft authenticator with biometric confirm and server push, or a token you just press that's near your computer or phone. the fact that these can also help defeat phishing is just one more benefit.