A key difference here is that the proposal is to send a short-lived login token via email. Even if this is intercepted the attacker will not be able to do much

A key difference here is that the proposal is to send a short-lived login token via email. Even if this is intercepted the attacker will not be able to do much before getting caught -- the window is going to be less than a minute. After that the token is a cookie stored on the user's computer. It is also worth pointing out that a number of sites allow passwords to be reset via email, and so an attacker who can read your email can potentially gain access anyway.