The language of the messages is littered with expectations to use a "mobile device" or "mobile app". While this is the most common method, other methods do exist, and we actually do have users without smart mobile devices.

Additionally: T150565: Support physical OATH/OTP devices