A phishing page can simply imitate the 2FA step in the login process and ask for the OTP to be entered, and then use it for its own login attempt. With U2F, the

A phishing page can simply imitate the 2FA step in the login process and ask for the OTP to be entered, and then use it for its own login attempt. With U2F, the site basically authenticates itself as well, so a third-party phishing page wouldn't get anywhere.