The pin might be stored in plaintext but should be stored in some sort of secure location on a chip that can't be accessed physically or through brute force. On

The pin might be stored in plaintext but should be stored in some sort of secure location on a chip that can't be accessed physically or through brute force. One strategy to prevent brute force the chip may only allow X tries before wiping itself. So the "something you have" is only something you have if you also have the pin. There are already 2 factors baked in.