Blizz can only do so much security wise on there end, but it also comes down to each client machine and there level of security. I do think this move is a good one, i never log onto wow anywhere else except my room on either my laptop or desktop. In all reality for someone to falsely log onto wow from my PCs, they would need to know my windows log in which is 19 characters long with grammar, capital letters, lower case, weird characters and numbers, then would have to know my wow log in password to hopefully get a free authenticator log in.
If my level of security was shit house and i had keyloggers and all sorts of shit, then a hacker could log into wow as im putting each password in anyway so,
overall i like this new change, as i hate putting in my code all the time.