>> I basically cannot come up with a situation where popups are actually an unavoidable and proper good choice

How about pop-up with 2fa request? Better to have pop-up for push notification than to look for auth app by yourself.