From a customer's perspective why wouldn't someone opt into this model? You're telling me I don't have to remember an extra password to log in... AND, if a service gets hacked, it's only them that got hacked; I don't have to go across all sites where I reused that password and change it. The burden of security is not on the customer any more.

And I get your point about MFA. But, that's it, MFA just adds another step for me to get where I was going. But my proposal removes a step.

But you're right about SMS being easy to hack. More thinking is required on that end.