TOTP is the superior option, IMO, but I’m no expert on security so maybe they’re insecure? it sure seems like some folks would rather do anything but time-based onetimes.

hardware keys are a pain in the neck, just one more thing to be lost.