I think two things can be true: 1. Phones are an important attack vector to consider 2. We should be using strong 2FA ala FIDO2 Given that phones can act as

I think two things can be true: 1. Phones are an important attack vector to consider 2. We should be using strong 2FA ala FIDO2 Given that phones can act as FIDO2, I think that only strengthens (1). Even if a phone isn't used for 2FA, it still is likely to have access to company resources - Slack, Email, non 2fa text messages, etc.