This is likely because the threat model does not include a threat for data which is collected for advertising purposes, but rather prioritizes the threat of ran

This is likely because the threat model does not include a threat for data which is collected for advertising purposes, but rather prioritizes the threat of random hackers or mid-high-range resourced state level actors. While Google is certainly a threat for those of us who value privacy, this is a different issue than being persistently targeted by resourced hackers. Also, Google are one of the more secure email providers, they spend a fairly significant amount of resources towards researching and defending against resource rich state actors. This combined with how seemless they’ve made hardware based 2 factor work with their products makes them one of the better options for anyone who will be persistently targeted like a journalist. And anyone with a threat model similar to a journalist will be using u2f if they have any technical sense whatsoever.