Seems alright to me (minus your personal issues). Just a username and password is really not substantial enough. The biometric prompt on your phone is just 2FA. You could have a memorable word - but who likes those.
I guess they could probably reduce the security for known devices/locations? I assume the last review step with the PIN prompt might be just for new device logins?
I do agree that a magic link while awesome on a phone can be a bit problematic on a desktop though.