These are the ways the strategies differ:

- a token can be invalidated individually, while resetting a password invalidates all sessions

- a token can be given a predetermined expiry without the issues that arise from predetermined password expiry

- a token can be given a limited permission set

- a token can be used to track the origin and extent of an attack

In practise for something like TeamViewer I find it likely that none of these except the first would be implemented. If the attacker has access to the registry chances are you're f*cked anyway.