There are some short comings about using email codes but I fail to see how this worse than passwords when the same exact kind of attack would work for passwords. The difference being that it would be worse with passwords which can be stored, reused later or sometimes changed directly on the service.

My password manager will never fill my password into the wrong site. I would need to do so manually which sets of so many alarm bells in my head.

With email pasting the number into a random website is the expected flow and there is basically no protection (some phones have basic protections for SMS auth but even this only works if you are signing in on the same device).

OP is just ragebait for nerds. How many articles have been published in the last 20 years about the issues with passwords? Now we're saying that the small chance some user ends up on bad-minecraft.com with a login form is actually worse than using "L3tmein!" as a password everywhere? Please find something more worthy to spend your time thinking about.

I came to the comments to say this. Nevor and I are one.