The flow requires both devices to be in the possession of the account holder for the migration to start, mitigating any risks of foul play. I just tried migrati

The flow requires both devices to be in the possession of the account holder for the migration to start, mitigating any risks of foul play. I just tried migrating on my (Android) phones. If an attacker can get you put in your passcode, they don't need to mess with migrating between two phones.