This makes sense. It's not a second factor if all elements live on a possibly compromised device.