agreed with first two sentences.

but, "..which you unlock with your password and/or biometrics"?

unlocking with biometrics is actually the problem, regardless of where the unlocking takes place.

relying on a third-party device that you can't even verify is in the custody of its user as "the only secure way to authorize actions" is highly problematic for similar reasons.

and confirming "from other devices" rapidly turns into a user nightmare.

the irony in all this is that lengthy, strong, non-reused passwords are actually pretty secure, and they don't require any specialized technology or rely on possessing a device that you just forgot on the airplane seat pocket and is now winging its way toward another country.