That is not entirely correct: Imagine an attacker gets access to the victim's iPhone and passcode, but they couldn't disable the tokens, which is what you want. Since you are logged into your Apple ID account on said iPhone, the attacker can access all your data, iCloud and local, wipe devices through Find My, and so on. This can always be done regardless of whether tokens are implemented Apple's way or your way.
However, I do admit that it will make account recovery much harder, if the tokens remained active you could always prove that you are the account owner. Apple's implementation turns your iPhone into another token.
This might make sense: Imagine you have the first token on your keychain or in your backpack or purse etc., and the second in a safe at home. You are at home and a fire breaks out and the only escape is through the window. The house including safe burns down. What are you most likely to have on you? Your iPhone, in your pocket.
So it would make sense that your passcode protected Apple devices remain as the final recovery possibility. Apple's threat model just doesn't seem to include attackers that know your passcode. Which seems fair to me, although it's obviously not how it works in the real world. However, attacks where the passcode is spied are not exactly common.
It would be best if Apple offered users a choice: Should the iPhone act as a token itself? Or should it behave the way you want it to? Personally, I'd certainly switch it over to how you'd prefer it as well. But I am sure many users will prefer Apple's way. That's my main issue with Apple, they only ever do it their way and you can take it or leave it.
How so? If you die unexpectedly you probably didn't get a chance to wipe your keys. And if you did, you could just as well have wiped the devices instead of the keys.
