When you lose the phone the app is useless and cannot be abused without knowledge of a pass code that one has to enter each time upon login. It's an intelligent design to provide a strong key that is heavily encrypted to log onto ib but via a mobile app with only knowledge of a simple pass code which can be as short as 4 digits. The pass code is only in order to avoid abuse should the phone fall into the hands of others.
What happens if you lose your phone or wallet which contains the card? I'm more comfortable with the old fashioned printed code card. I have a photocopy of the card by my desk which makes it hassle free.