Further, it's completely non-obvious to 99+% how to use a hardware key, let alone why they should. 1% who get it, might even be generous. And then, quite a lot of people have devices that can't use hardware keys, or shouldn't. I have any number of clumsy friends who shouldn't have something like a hardware key sticking out of their laptop at all hours of the day: I call it, inevitability.
Someone using a hardware key, probably uses random passphrases for each of their online services, stuffed into a password manager. Ergo they aren't low hanging fruit even without a hardware key. How much safer is someone who uses push authentication as their second factor, switching to a hardware key?
Anyway, a big part of what I think you're getting at is ordinary people lack the imagination of the risk they're taking; but then there's symmetry here because you lack the imagination that they have so little of it themselves.