It is strange to me that both this article and commenters in this thread complain about "email security" as being a limitation of magic links, given that the vast majority of password authentication websites allow an email-based password reset flow. Magic links aren't any more or less secure than allowing email-based password reset.