I would accept this argument if I had ever in my career run across a case where somebody discovered that their token was stolen and reported that within an hour.

I grant that this can happen at scale, e.g. Dropbox, or for sensitive systems that give mutating access to financial instruments, but for the _vast_ majority of businesses, this is a completely hypothetical problem.