The main problem I see (based on the screenshot in the article) is that it still allows the attacker to initiate the auth flow from the outside, and the clueless user would in doubt just unlock for them. I don't see how the proposed scheme would prevent this phishing attack. It seems to be worse than the SMS 2FA part where one would at least have to enter the SMS code into some suspicious website.

My method of choice would rather have been what is established now for 2FA with time-based one-time passwords (TOTP). Here the attacker can't initiate the auth flow from the outside.