But they do use apps, and since everything happens on a smartphone - a single point of failure - they aren't independent.

Like most security regimes, it's both overly prescriptive and woefully insufficient. In short, dumb. :(