Although you could use local storage, you would have to do that with every browser you logged into and also somehow make it user-account-specific. I definitely see the challenges there for them.
What would you think about using a user's password to encrypt the browser keys and store them on Facebook's servers? Is that too large a compromise for usability?
What did the OP mean by "No secure way to verify code or store keys (in web browser) without routing through mobile" ?
This is why Signal and WhatsApp require the client to run on the phone - the phones are doing the decryption for the web apps.
This is flaky, consumes a lot of battery and generally is somewhat error-prone - probably not something FB wants to deal with.
Installing a malicious extension, tricking users into typing commands in the developer tools, XSSing FB, all of these are much easier to do than attacking a native app on a phone.
Certainly it can be important to know when you have a "no compromises" security option versus "mostly better than plaintext but maybe not secure".
It could be a UX judgment to not confuse users they have a "secure connection" when in fact they might not. Look at all the various attempts over the years browsers have made to keep the UX semi-reliable and easy for users to understand whether or not their SSL connection is secure.
You could even register only the browser, without having a smartphone at all.