They help against phishing and password theft, as it requires a physical item in addition to the password. Doesn't matter much if someone downloads a Word doc with macros and runs it.