Passwords fail predictably
Reuse and phishing defeat complexity rules entirely. A second factor means a stolen password on its own is not enough.
Which factor to choose
App-based codes are a large improvement over nothing and over SMS, which can be intercepted through SIM swapping. Hardware keys are stronger again where the account justifies it.
Plan for lost devices
Store recovery codes somewhere the whole team cannot lose at once. Most rollouts fail not at setup but at the first lost phone.