Effectively, after this change, it's become even more vital that people use the authenticator, since the password is otherwise the only thing that an attacker would have to guess! That password is then the only thing standing between them and credit card fraud!
You know, I wonder if that's their intent? They want everyone to buy the authenticator? Granted, I use the mobile app that's free, but still.