> No MFA protects against social engineering That's true - some kinds of social engineering cannot be prevented by technical means. BUT hardware keys prevent a

> No MFA protects against social engineering That's true - some kinds of social engineering cannot be prevented by technical means. BUT hardware keys prevent an entire class of extremely common attacks that every other form of MFA is vulnerable to. It would have prevented the method of compromise used here. Any company not using FIDO/WebAuthn in 2022 is behind on best practices.