Yes - the paper does acknowledge this, and makes the assumption that the point of entry is physically secured, for example by a human guard standing watch. This

Yes - the paper does acknowledge this, and makes the assumption that the point of entry is physically secured, for example by a human guard standing watch. This means you couldn't kidnap someone, steal their TOTP token, beat the password out of them, and then go to the location and authenticate as them. It doesn't help in a situation such as being able to log in from any internet connected terminal.