I've avoided getting a Yubikey because there's not an easy way to use it on my iPhone, sticking with TOTP. But that's a bit of an edge case. (iPhones lack NFC chips)
For the time being, passphrases + TOTP 2F are sufficient, but I will look forward to being able to use a security key instead.
Yes, IIRC it's impossible (or nearly so) to phish U2F.