And then there are UI/UX constraints. The Venn diagram of "knows how to use SMS", "knows how to use 2FA" and "knows how to use yubikey etc" does not have a lot of overlap outside a tech audience.