> they are supposed to be device-bound

Which in and of itself should already be a super obvious total no-go. Every device will eventually go out of service or will be decommissioned, for a multitude of reasons. Then what, I lose all access, because I went from an iPhone to Android? WTF?