What is WoT? Does your system send a single-use code to the email, or some other method? I cant imagine a way to login to the account without some secret key, and that creates a dependency that might make the app unusable in another way on older devices.
I use a combination of cookies, fingerprinting, and web-of-trust verification (by volunteer moderators). The WoT works by building a DAG of "vouch" tags for each user. For more capable browser, client-side signing using a private key is available.
There is always an accessibility-security gradient, and there are trade-offs you have to make on every side. The needs of each user are different, and many would prefer to trade a lot of security for a lot of accessibility.
For example, if someone un-housed is only using borrowed devices, older tech, library computers, public wifi, many would happily trade some security for being able to let their loved ones know they're OK.
They're not worried about espionage or privacy, they just want to be able to send an "I'm OK" message to their family every day or two.
For this type of scenario, and many others like it, a simple http-accessible website behind a simple password is by far the best solution I've found to date.
