You can invalidate tokens for a compromised phone. Well you can also change your password, but I'd rather revoke the access from my phone than have my password stolen. Some kind of validation mechanism before you order could be nice (like a screen lock), something you can do with one hand.

Many services grant fewer capabilities to a session authenticated only by token. In the case of Starbucks, you can buy a coffee or even reload the card from the user’s bank account via the app, but you need the password and the web site to change the user's mailing address. Therefore, this vulnerability might enable an exploit such as draining your bank account into gift cards that I send to my address, whereas access to your phone and token would not.