Comment by jdashg

It only has to be as secure as password reset.

Passwordless login is just password reset without a password, neatly removing the weak link in the chain.