U2F literally stands for “Universal 2nd Factor” so it’s not a replacement for passwords (the first factor). They are not comparable.
Not using a U2F key makes you susceptible to phishing attacks.
Not using a U2F key makes you susceptible to phishing attacks.
U2F credentials are tied to a particular domain, and so do not rely on the user making sure they are on the correct website. As such, they are not susceptible to typical credential phishing attacks.
This is assuming an owned machine. Not the easiest attack but still possible. Obviously things like Google Authenticator (while good) are even more susceptible to MITM phishing.