The device stays with you. Yes you have to activate it to get or read the code but then you enter this into the regular TWS login screen. Think of the device as a 1-time password generator.
If you have some process that automatically logs into TWS running on a remote PC such that you never wee the login screen, this will be a problem. But, frankly, this architecture is an accident waiting to happen. For one thing, you will not see any of the warning messages we generate to alert you to possible security issues at login time. You will be able to opt-out of the security program but then any problems with your account (hacks, unauthorized withdrawals, unauthorized trading) will be fully your responsibility.
To clarify: most of the account compromises come from worms inadvertently loaded onto the users PC which carry a "payload" kestroke logger, or open firewall ports to allow malware to be loaded through a backdoor. Look up Bagle Worm on google to understand what I mean. Whenever the user enters his/her password, the logger captures it and sends the data home to the mother ship. Changing the password will not help (much) as the new password is also easily compromised.
The second common source of password compromise is as simple as the use of a computer over someone else'e network. For example, a hotel or internet cafe. I am a security extremist and I avoid these things but if you are traveling, you need to log in. If the network is run by someone with bad intent or is simply itself compromised with malware, voila, there goes your password.
Both of these scenarios are created by a failure on the client's side to confine his/her login activity to 'sterile' environments. But we live in the real world, so IB recognizes that even prudent users may still have their password compromised. If this happens, we make a judgement call based on analysis of the circumstances as to how far we will work with the compromised account to repair the damage. Clients who work to protect their own account (in other words, recognize security over convenience) are evaluated in a much more cooperative light.
You need to keep the following in mind: 99% of all account compromises (on all internet systems around the world) come from the client/account holder side. By not using the available security resources, you are effectively choosing to self-insure. The opt-out allows you to self-insure but we strongly discourage our clients from inviting such exposure. Unless you are as specialized in computing security as the hackers are in breaking past security systems, this is a game most people cannot effectively compete in, and the Security Device evens that playing field.
