> Also, anyone who still can should print out Google backup codes and store them somewhere safe.

The 2fa set up process for many websites (and iirc Google too) do not make this a priority. They should clearly emphasize the importance of saving the backup codes, and make you check a box that says you printed them. The 2fa should not be enabled until that is done.

I remember within the past few years when I was talking to someone who seemed to be unfamiliar with the idea of storing all your really important papers in a safe deposit box. I'm not sure if that's the times have changed, or the particular person I was talking to, or that it never was that standard.

Google Auth now enables you to export codes. I have the same authenticator on multiple phones at home (being a mobile dev i have a crapton of phones)

You need more than one Yubikey and probably three. Keep at least one somewhere reasonably remote and safe (lockbox, your parents' house, etc).

...not to mention there is or was an option to delete email automatically after downloading, that I used to use.