If you have your phone stolen, and the thief tries to sign in to Medium, Medium will send that code to the phone that is now in possession of the thief.

Strong passwords are the best security measure and are all that is really needed. Everything else are unnecessary gizmos a company is trying to sell us to make money.