The downside is not touched upon, however: losing access to an mfa account because the mfa is lost. This can happen in a multitude of ways. Losing a phone, wiping a phone, changing phone number, losing a hardware access key, losing recovery keys (if they're even provided, many times they are not), etc. It's inconvenient too, especially for sites that require it on every log in and whose sessions were short lived (aws). Or refreshing everything when the mfa changes including codes. I have almost 500 logins in my password manager. That's 500 potential mfa code generators and 500 sets of restoration keys. All I'd have to manage manually (pw manager can help with the keys but it's all manual).