This could have been done by issuing a private key stored locally on device via Bluetooth. 2FA by requiring biometric on opening the app. Bonus points for allowing USB and then use whatever that monstrosity is as fallback.

Then for other sensitive details have whatever account do go through one time proof of ownership flow.

Doing it this way is just lazy.