My account has been in serious danger of being hijacked 2 times in the last several months without any interaction with phishers or malicious websites. People are quick to give the "well you won't have any problems if you're just not stupid" speech (as did I many years ago) but the truth is that sometimes even the most security-conscious people get screwed by a series of unfortunate events. Maybe my password was too similar to another that was leaked when a website had its security compromised, or maybe there was malware that I still haven't discovered in a downloaded file that looked completely safe. I can't be sure. You can call that "stupid" if you like, but I consider myself very careful about suspicious internet things to the point that it might be considered paranoia, so all of my actions were taken with utmost caution.
The point is, if I had not had mobile authentication I might have been in serious trouble. I'm not sure if they had access to my email or not, but I feel infinitely safer holding the key to my account in my hands rather than having it sit in an email server. I'm truly sorry that those of you without the means to use the mobile Steam application have to suffer a two week trading "penalty", especially because I've been in similar positions in the past, but Steam can't forfeit higher account security just because some people aren't up to date with technology. Smart phones have been commonplace for around 10 years now; I know that doesn't mean anything to people who can't afford one or can't obtain one because of other circumstances, but the rest of the world is moving on. It's a 15 day wait for virtual items, you'll live. Get a long-time friend to get the item for you and you'll only have to wait a week for it to be tradable and an extra day for the trade to go through.
The one exception is people with Windows phones who apparently can't run the application, that's something that Steam should have taken care of before announcing this new policy and you have every right to be upset about it.