I can agree with this, but I think the hardware tokens compared to regular client certificates have the same issue: better average case (if it works it much easier to use it on multiple machines) but worse worst-case (a missing driver will completely shut you out).