Are they? They don't mention anything about replacing 2 factor here.
A typical login is compromised if you know the password or if the email is compromised. This is not increasing the attack surface.
Some websites just don't need such a high level of security plus you could argue they are probably less careful with your password than say Google is with your email.
Now it can still be hacked but you could argue this is probably an increase in security although it does create a central point of failure just like password managers.
Nobody says Google or Amazon should start using this but websites with a lower requirement of security shouldn't inconvenience their users unnecessarily.
If you're only need is to identify the user for something banal that couldn't do much damage if it gets hacked then this is a good solution.
https://fidoalliance.org/adoption/video/how-the-nok-nok-solu...
Or this maybe: https://www.grc.com/sqrl/sqrl.htm
It's a QR-based system, but according to that page it says it can work via a tap or click on the QR code, too. So you don't have to point a camera at the QR code.
https://www.grc.com/sqrl/implementations.htm
Wordpress, Android, .Net Client, Node, PHP, Ruby, Windows Phone, and Haskell. Unfortunately, having people download an app to login to your website kind of ups the bar a little. Still, they can just scan the code with their phone as well.
"No, email is not a secure medium. It was never designed to be one. It’s susceptible to Man In The Middle (MITM) attacks and a slew of other issues. Users might also have their email accounts abused or hacked into (how many people do you know who have left their GMail logged in on a public computer?). And what about if their email provider gets hacked or their backups stolen?"
Mozilla should know that email is not an adequate medium for one-time password delivery.
They are replacing strong authentication (2 factors) with its second factor alone.
[1] http://plaintextoffenders.com/faq/devs [2] https://news.ycombinator.com/item?id=7943365