At any time you'd have two passwords: one regular, which you use every day; and one for one-time-use only, which you keep around in case of need.
When sitting at an untrusted computer, you use your one-time-use password. This proves your identity, but also immediately expires your one-time-use password. Next time you want to generate a usable one-time-password you'll have to login with your regular password again.
Is that it?
But they don't require my normal password to be entered at all. I'd accept punching in my real password or a code on my phone to generate the smart token, since the time required to brute force something like that would be give me plenty of time to revoke it's authorization.
Maybe possible with 2-factor-auth, but it would still require me to input my password on an untrusted device. No.