That's true of SMS 2FA too, though, as well as many TOTP implementations. Being able to copy credentials to a new device is a major usability plus, consequently

That's true of SMS 2FA too, though, as well as many TOTP implementations. Being able to copy credentials to a new device is a major usability plus, consequently it is widely implemented. Physical webauthn tokens are obviously better, but software webauthn is the second best thing. Software TOTP is a good bit worse, and SMS OTP shouldn't even qualify as a secure method