Post its at home can be stolen, or photographed, while I'm out of the house. My phone plus my face? Without me noticing either? Not as easy. I still keep print

Post its at home can be stolen, or photographed, while I'm out of the house. My phone plus my face? Without me noticing either? Not as easy. I still keep printed one-time recovery codes locked up and hidden to not be completely surrendered to my phone, but i don't really like them since they can be copied without notice, only comfort is that usage of them will trigger notification, yubikeys feel like a better middle ground.