> but why can't I have password + (security key OR single use code)

That’s actually pretty close to what they support, except that the OPTs are only sent to your trusted Apple devices (you can’t use an arbitrary TOTP app).

> since if I lose all my Apple devices I'm locked out

They also support a 28 digit recovery key you can print out and a method for trusted contacts to help recover your account.