However I'd guess it sounds like it wants a second device to authenticate ... there's no way that sort of idea for security could backfire ...
Google is trying to manipulate the market [1] [1a] ...
I'd comment further but the criticism will come off as snarky.
[1] https://news.ycombinator.com/item?id=48478643
[1a] https://cybernews.com/privacy/google-qr-code-recaptcha-requi...