OK thanks, this clarifies the part that says "it began requiring all employees to use physical Security Keys in place of passwords and one-time codes," which I found super confusing.

Strange sentence, but I believe they mean replcaing "password + one time code" with "password + U2F"

Actually U2F can be used to devise several different schemes, either token+password, or token alone, even just token without username. Of course each of these has various advantages and disadvantages.

Some logins are cookie + security key (basically if I've already logged in today) which basically feels like "tap my security key and I'm logged in".

Of course, more sensitive stuff (access to production, access to pay stubs, access to $cloud_erp) requires re-entering password plus the security key.

The password can be replaced by something simpler like a PIN, which is why you'll read about U2F replacing passwords and one-time codes.

Sometimes 'replacing passwords' is used to mean 'replacing the traditional username and password login' as well.