Vanguard also offers 2FA with voice-automated calls. I wonder, would getting a landline and using that with a Yubikey be any more secure?

https://investor.vanguard.com/security/security-keys

Vanguard can work with Yubikeys now.

I would consider that an alarming sign that I need to change investment companies asap (probably after loudly complaining and trying to change it, since Vanguard is somewhat unique).