They could add it as part of the OTP app, so itd be locked to only a single device thats directly connected to the account.