Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has

Mostly because, thus far, it has the best user setup experience (doesn't require user to download a new app and hence can often get enabled in seconds) and has the best "lost device"/"broken device" story (people tend to not have their backup codes). I think things like Soft U2F can change that equation a bit. An iCloud keychain synced 2FA credential would go a long way toward addressing some of the usability issues with traditional TOTP based 2FA.