It's definitely not strong against the same breadth of attacks as a physical key, but I'd argue there's a place for something like this.

This would still protect against phishing, which is probably the bigger risk for the average consumer.