If they're just files on a flash drive, what stops someone from just copying the files to another drive? Its just moving the same issue up a level in the stack,

If they're just files on a flash drive, what stops someone from just copying the files to another drive? Its just moving the same issue up a level in the stack, and in many ways making it easier to clone it. One of the whole points of authenticator devices is that the actual key material isn't directly readable. You shouldn't be able to trivially reproduce the device.