As a counterpoint here, email- or sms-based passwordless flows can be quite slow to complete. We (clerk.dev) are seeing ~35 seconds for passwordless, ~8 for passwords, ~5 for Social Sign In: https://www.clerk.dev/blog/designing-fast-sign-in-forms

We're excited for other factors to gain more prominence (e.g TOTP, face id, touch id), but in the current world it's hard to recommend against a password factor, as long as you're following NIST guidelines to compare against password breach corpuses.