Passwords fail predictably

Reuse and phishing defeat complexity rules entirely. A second factor means a stolen password on its own is not enough.

Which factor to choose

App-based codes are a large improvement over nothing and over SMS, which can be intercepted through SIM swapping. Hardware keys are stronger again where the account justifies it.

Plan for lost devices

Store recovery codes somewhere the whole team cannot lose at once. Most rollouts fail not at setup but at the first lost phone.