There was a recent discussion on HN that branches into this idea about the importance of UX. I agree with you, with a twist.

What you want is that the happy path for security is zero hassle, but the unhappy paths should also drop dead with zero hassle.

This is the UX I really like for WebAuthn / U2F.

All the interactions on the happy path are very smooth. Need a second factor, tap, go. Almost frictionless. On my phone for example you tap the same fingerprint sensor that would ordinarily unlock the phone. Short of not having a second factor at all it couldn't be smoother.

But if this is actually a phishing site or you're a crook who doesn't have the hardware token, it just doesn't work. Still low friction in a sense, but low friction failure. There is no way forward, no override, no "I'm sure", nothing - it just won't work.