Your IP should provide them (and your bank) enough location info to alert you if your account is accessed from another state/country. QR codes weren't needed to

Your IP should provide them (and your bank) enough location info to alert you if your account is accessed from another state/country. QR codes weren't needed to set up the hardware token, so that feels like a feature created to justify the increased access (also phones come with their own camera apps capable of reading a QR code or at the very least photographing one). The mic access is a side effect of android's leaky permission system which hands out the ability to record audio to any app that wants access to your camera.