Not from what I have seen. For example phone-app based auth has your phone as both what you have and the code you enter or button you press as another factor but in reality that is just one phone. I have seen a place where you can take over the org if you steal one guy's yubikey. Windows hello has a pin for what you know but then it authenticates the device with TPM instead of you separately as a user. But at least windows hello requires you to remember a pin other methods have secrets generated on the fly which I am certain are phishable or just use what you have alone as a factor of auth.

I mean, at least have users define a multi word passphrase with no complexity condition or expiry.

Try this demo: https://www.passkeys.io/

Not able to. Touch/faceids are another class of bad security design.