Some logins are cookie + security key (basically if I've already logged in today) which basically feels like "tap my security key and I'm logged in".

Of course, more sensitive stuff (access to production, access to pay stubs, access to $cloud_erp) requires re-entering password plus the security key.