I disagree with your second point. I manage a financial services portal that uses what looks like this same system (from RSA). We deployed it to satisfy regulatory requirements. Any time there is a hiccup in the system (such as RSA's servers going down or slow) we are flooded with calls asking if it is safe to login. Our users are not tech-savvy, and many are 40+.