Enabling `tty_tokens` still remembers your authentication for a few minutes, but it restricts use to the terminal it was run on.

Yeah I was thinking the same thing, probably that is why they ship those defaults, better UX.

Passwords are both security flaws and UX features -- they're inherently flawed, cannot be fixed, and are the only authentication system most people can use successfully.

Security is always in tension with usability.

I think the flaw marcoamorales intended to point out is how sudo doesn't always re-prompt for a password.

It is a feature that it caches your authentication for a few minutes. It's not a feature that other processes running as your user, such as something that manages to do a sandbox escape in your browser, are also able to acquire credentials.