While what you say is true, e.g. WebAuthn + trusted platform module on mobile phone is the lesser evil for the most consumer use cases. It might not be lesser

While what you say is true, e.g. WebAuthn + trusted platform module on mobile phone is the lesser evil for the most consumer use cases. It might not be lesser evil for all use cases, but it wil be the lesser evil for retail banking, Ecommerce, Steam accounts, OnlyFan creators, cryptocurrency exchanges, social media accounts and such. We are talking about billions of medium security accounts, not handful of high security accounts.