A good one-time-sign-in-link implementation will send a link to authenticate a session elsewhere, so you can click the link on your phone to complete login on the computer.
They did a nice job on that one.
However, the problem is that this goes so much against user expectations it just confuses people and they end up going through the grueling version of typing the long link in by hand in VR since they can't imagine it could be as easy as opening it on their phone. (We of course, call this out in the prompt, but nobody reads that.)