Yes that's why I continue with my HSBC physical number generator and don't use a phone app (I don't have a smart phone anyway) despite the logon always encouraging the changeover.
And you can lose/have stolen your phone when you're out but you're unlikely to take your number generator around with you to lose.
Given the article I think in principle the code could still steal such a generated number when you type it and report that the website is down for 12 hours whilst they make use of it though it would require quite a bit of achievement if you have to match IP etc unless the computer is remotely controlled whilst the website is 'down'.
Similar thing with passwords - have part electronic and part physical so you can match them together when you're out and about but if someone steals either they haven't got your password. Or you could even use passwords generated from the text of an online book and you only know which book and your passwords when written would just be a sequence of page-line-letters, or have a random letter grid and your password would be a sequence of row-column cells, or have letters written down but a non-public online script that transforms the input into an actual password...
d