I find this to be a regression in terms of usability and security as well. On top of what you mentioned, it also fails really hard when someone has access to y

I find this to be a regression in terms of usability and security as well. On top of what you mentioned, it also fails really hard when someone has access to you and your trusted device (which will be the smartphone in most cases). It's already an issue allowing easy access to smartphone content, it will extend it to any account using that method of authentication.