You mean token theft? Most sites let you add factors without step-up auth once you're logged in [1]. That's what attackers prefer to do, vs. locking users out, which just gives away the game.

To be clear, end-running around hardware keys with stolen tokens isn't hypothetical. See for example the fallout from the last Okta breach at Cloudflare: https://blog.cloudflare.com/thanksgiving-2023-security-incid.... I make my team use YubiKeys, but there's no upside to being naive about what they are and aren't good for.

Anyway the kinds of sites you're describing are vanishingly few. What people mostly have to deal with are sites like Fidelity's. If you want something other than SMS or push notifications, you have to call Fidelity on the phone, and then all you get is Symantec's bloated wrapper around TOTP.

1. It's even the default in some major identity providers, like Microsoft's (https://learn.microsoft.com/en-us/entra/identity/conditional...). Okta is better, but then their default session length is forever, so moot point.