anything other than username/email + password is stupid bullshit, i don't care what any cybersecurity nerd says.
Some are literally so bad I just won't use them anymore.
All most of these things need is basic authentication, set some long-lived whatever it is based on the Secure Enclave, and if then don't allow seeing the charge method or changing the delivery address without requiring some second factor. You don't need full bank-level security for a burrito (amusingly enough, my bank security is more based on normal things than the burritos are).