* SMS (and automated voice call) are bad for people who live in areas with poor phone coverage, people with international phone numbers, and people who want good security.
* TOTP is bad for people who don't have smartphones.
* FIDO U2F is bad for people who don't have $20, safari/iOS users, and people whose devices don't have USB.
* Vendor-specific apps are bad for people who don't have smartphones, people with low spec or poorly supported smartphones, blind people, and the privacy-conscious.
* Smart card readers and physical tokens with screens cost $$$, often aren't accessible to blind people, and are too bulky for users to carry more than one or two.
* Paper single-use codes are bad for people who log in regularly, people who don't have printers, and don't scale to multiple services all that well.
* All of the above are bad for people who are forgetful or clumsy enough to regularly lose or break the second factor.
WITH THAT SAID, you can still provide Hacker-News-reader-approved two-factor authentication by basically copying Google: Offer the user TOTP, FIDO, SMS and paper codes, let them choose any two.
Gain bonus points with a setting that stops customer services resetting the password or disabling 2fa, and a week-long warning/waiting period in case account hijackers dial up the security settings to stop the original user getting their account back.