My point is the other methods should not be considered acceptable as 2FA because they are phishable. But yes, I'm sure there are competent auditors (as opposed

My point is the other methods should not be considered acceptable as 2FA because they are phishable. But yes, I'm sure there are competent auditors (as opposed to the ones who are financial auditors from accounting firms and completely out of their depth in matters of security). The problem is that unless there is a big stick, like a cybersecurity insurance company saying "unless you use U2F keys for 2FA, you are not covered", there is no incentive to change.