True, but I think most people are signed in to at least one email account on their phone, so in the ideal case it's as easy as two clicks: 1 to open the email notification, and 1 to click the magic link.

I wonder if it could be securely done with the web notifications API, to make it 1 click?