Agreed. You are only ever as secure as your weakest link. If someone else has your device that is not protected by a pin and you are not able to remotely wipe or lock, then you probably have bigger problems.

I like seeing these sorts of solutions put to use. It will be even more user friendly with the use of Apple Watch, as an example, if you are accessing your account on something other than your phone.

Now, email is a pretty important thing, so it may not be the best place to experiment with new login methods. I like the way searchpath.io uses email authentication, rather than passwords, and I am implementing something similar for a side project.