It is actually a remote connection to a real phone, so since the resources are quite finite, requiring a second factor makes a bit more sense.