They're cheap, they can easily be changed, they're compatible with everything and everyone (including developers) is already comfortable with them. U2F/Fido wi

They're cheap, they can easily be changed, they're compatible with everything and everyone (including developers) is already comfortable with them. U2F/Fido will probably take over in corporate environments, aided by SSO, in the next decade or so, and consumers may follow, but recovery is a huuuuuuge problem for those who can't punt that problem over to email providers.