TOTP is the superior option, IMO, but I’m no expert on security so maybe they’re insecure? it sure seems like some folks would rather do anything but time-based onetimes.

hardware keys are a pain in the neck, just one more thing to be lost.

I don’t know anything about passkeys but if Microsoft is pushing for them I am immediately suspicious. I am admittedly paranoid but if you have been an adult using a computer over the past ~15 years and aren’t paranoid you haven’t been paying enough attention