The problem with hardware tokens is that they 1) Only store a limited number of logins, 2) It is very difficult to keep them in sync- every time you need to add a passkey, you have to get them both out, which makes it difficult to keep one a in a secure safe to keep it safe from damage/loss

This two fatal flaws are what limits their usefulness to enterprise SSO and perhaps some other limited uses where the organization has the ability to replace tokens. (Even in a distributed enterprise, enterprise SSO may not be a good fit for hardware tokens, if they can't get replacements out to employees fast enough).

Enrolling two devices stored in different locations for every sign up is extremely annoying.

I suspect that most people that ostensibly do this actually only enroll one for non-critical accounts and then depend on some fallback mechanism.

The problem isn't the cost of replacing it, the problem is - how do you log in when all your passkey-bearing devices just got flushed down the toilet?