I am all for taxpayer funded "everyone gets a WebAuthn token or two to put on keychain" and requiring banks and tax authorities use it. No SMS, ever.
If stolen, has little to no resale value and zero personal information on it, and you can unregister the key from online services