It forbids 2FA with anything other than U2F hardware, which is practically unphishable. I don't really trust the Google auth system without the hard "disallow all non-hardware-based auth" restriction, due to the innumerable stories about sim swapping, et c.