While it is arguably better than nothing (as it at least protects better against brute force attacks, and password leaking) there's a downside to projects like

While it is arguably better than nothing (as it at least protects better against brute force attacks, and password leaking) there's a downside to projects like these (and the leaking of passwords could be mitigated by any decent password manager, ie. don't reuse passwords). Services such as websites assume and grant trust levels based on if you have 2FA enabled (such as requiring 2FA for certain operations). Instead, if you don't use hardware 2FA, they shouldn't grant the same level of trust as when you do. The example of malware is mentioned in the README. The secondary reason I use 2FA is stolen device. I keep my hardware token separate from my device when I don't use my device. Also, the README does not mention FIDO2 at all. IIRC that had further protections against malware, but I'm not sure. The README is out of date regardless.