hardware tokens are like 10 bucks a piece.
they are cheap as fuck.
there is no employee not worth 10 bucks for ACTUAL SECURITY.
telling them to install a shitty "authenticator" software on their own shitphone is the opposite of security. it's STUPID.