A closed-firmware USB key is really no better option.

Dear Yubico / Kensington / Google Titan, can I export my private key components to this other device, or even print them out on paper for storage?

No - you're just an untrustworthy user granted the fleeting privilege of using BigCorp devices. Now stop asking such questions or you might have your attestation revoked.

The issue is that operators can just curate a whitelist of authenticators they like. They could opt to not allow Yubikeys if they wanted.