Some actors doing unsafe things should not preclude us from building safe things in the mean while. Google/GSuite accounts matter. GitHub accounts matter.
This is a race against Mobile Authentication Taskforce and their fundamentally insecure accounts. If the solution can't beat them, it'll get trampled.
Those other "unsafe actors" are trying to completely take over authentication, meanwhile you need 2 $50 hardware security keys at a minimum to safely use this tech. This will lose on consumer pricing and consumer uptake to the insecure Mobile Authentication Taskforce and you won't GET the option to use a FIDO2, because you'll have the choice of insecure mobile auth or nothing.
You have to win against the public or they'll be suckered by bad and insecure authentication that is easier to use, and the things you want to use will be insecure anyways.
Yubico already make a Security Key that isn't also a PGP key store, a TOTP authenticator, bagel toaster and whatever else for about $20. And there are cheaper vendors if price is the main concern.
The argument seems pretty straightforward: if you don’t trust SMS, you need to disable all backup authentication. If you’ve disabled backup, you surely don’t your physical device to be a single point of failure?
It's the backup option, it's the reserve, it didn't have to be the best possible thing, just enough to get you back into the game after you lose the main token somehow.