I don't think the threat model for this cares about that. This is designed for home users who don't have security requirements that make them carry around OTP

I don't think the threat model for this cares about that. This is designed for home users who don't have security requirements that make them carry around OTP devices just to see their desktop. I mean, you can argue that passwords are pretty easy to copy as well -- you just need a video camera facing at the keyboard for a day or three.