Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phis

Definitely your second point, although it's worth noting that mobile authentication apps are still weak (although not as weak as just a password) to remote phishing attacks where security keys aren't. Mobile authentication apps rely on the user only typing that code into the right website—and people suck at noticing if they are on the wrong site. Right now, this is mostly only a problem with spear-phishing as most don't bother, but if 2FA becomes too popular, they'll start to adapt. Security keys, on the other hand, get the host directly from the browser. This means they should be safe even if you fall for a phishing attack.