App based 2FA is still more vulnerable to phishing than a U2F key, because it relies on the user to check they are entering the code into the right website. It

App based 2FA is still more vulnerable to phishing than a U2F key, because it relies on the user to check they are entering the code into the right website. It's also faster and easier (no pulling out your phone, getting a code, typing it in, just touch the key). Plus, the keys have other features (GPG keys, etc...) which can be useful.