So since my threat model isn't high and this would be more a nerd thing, it doesn't seem worth it. 2FA is good enough I guess
People have mentioned AWS IAMS only supports one at a time, but that's definitely "a nerd thing".
The only "normal" user-facing service I've tried with some unnecessary restrictions is actually Twitch (also an Amazon property), so it sounds like Amazon are just specifically bad at this, rather than most companies having bad implementations.
But in general, it's been fine for the vast majority of services.
There is zero evidence of any wear or anything. They are meant to be carried around, you don't need to baby them. I'm more worried about it being lost than damaged.
I am more concerned with losing my phone or that my phone will die that something happening to my ybk.