For me, a big concern is propagation delay in the email. It sends a token that is valid for only 5 minutes, but with greylisting performed by the spam-filtering

For me, a big concern is propagation delay in the email. It sends a token that is valid for only 5 minutes, but with greylisting performed by the spam-filtering machinations in my email provider, there is a good chance I will not get that email within 5 minutes. Trying to send a second one will probably result in some kind of exponential back off penalty also. For that reason alone I don't see how only using email verification as a low-friction way to log in makes sense.