> This is still nothing more than a password

No, it's an OTP. And that's so much more than a password...