I've once evaluated a product like this pretty extensively. This was about 5 years back and I think the company is now called Admit One Security.

Surprisingly enough, that company's userbase absolutely hated carrying tokens and they wanted to bend over backwards to accommodate them. The entire point was to provide an alternative way of doing 2-factor authentication.

The bottom line is that it mostly did work as advertised. The place where it struggled were poor typers of the hunt and peck variety. They just didn't have a good enough pattern and the failure rate was fairly high.

Another weak point would be any type of hand injury or even being under the influence would throw it off completely.

I liked the approach a lot, but ultimately, when it does fail, its extremely frustrating to the end user, since they don't really understand what they did wrong.