It needs to retain compatibility with the hardware tokens.
It'll forever be a code, it won't likely change to an authentication prompt.