A simple password or a pin code does mitigate quick attacks of opportunity using lost or stolen physical factor; and adds non-repudiation if someone uses someone else's token - you can't just say "oh we must have accidentally swapped our cards at lunch" if you had to enter their pin as well.
Given the existing password hygiene, I think it's more likely that any new PIN or password would be treated in the same manner as the existing ones, and would just be an additional hassle.
