Until web standard can agree to have device bound session, it won’t happen. Cookie stealer malware is just too dangerous to perform financial transaction. So maybe for read only stuff it is fine