A smartwatch as simple as a Pebble can run such an app already. For example, I authenticate with 2FA with e.g. Google & Facebook w/my Pebble.
The problem is that I don't want to use my voice for commanding that much. It has privacy implications. First, obviously there is data being transmitted to a US corporation such as Google or Amazon. Second, there is analog audio data being transmitted. For example, that TOTP token generally stays valid for 30 seconds. In this window, an attacker could open the door right after you entered. I live in an apartment, and anything I say in the hallway can be heard by other people living on the same level as me while they are within their house (yep, terrible design).
I do admit that in the privacy of your home such analog audio data works better than say in public via your smartphone. But then again, smartphone is a can of worms with more privacy implications such as screen easily being seen by bystanders and cameras (a smartwatch has the very same issue; Google Glass wouldn't!). For the phone, Google Home is an interface, and certainly not (yet) the primary interface. For Amazon Echo, Alexa is the interface.
Bottomline, we need to think of these disadvantages (share our thoughts about them), and understand when they're too big to be a valid use case.