If you want to know why people aren't adopting 2FA, it's because we know it's just a matter of time until the hole that attaches your Yubikey to your keyring wears away, your Yubikey disappears, and with customer service that amounts to "talk to the hand" at many sites, it's a digital death sentence.
Companies need to at least clarify “what happens if I don’t have my key” also one time codes are a thing that need to be saved and can help mitigate a hardware failure.
The point of 2FA is "something you have"... if you lose it, you no longer have it. It's designed to lock you out if lost/stolen... otherwise, what would be the point?
As an aside, 2FA keys are not what most people use... they use cell phone numbers, time-based rolling-code authentication apps, email addresses, etc. It's your choice to use a physical key, even if it might technically be the most secure of the options.
Security is always a trade off with convenience.
GP seems to not understand the point of 2FA. If you can simply call up customer support and maneuver you way back into a locked account, then so can the "bad guys". Any information they have about you can be found by a determined attacker... hence, the "something you have" approach.
The alternative is for me to use TOTP and have the secrets printed out, lightly encrypted, and stored in a safe deposit box.
I don't think wear-and-tear is why people aren't adopting them. I have a yubikey from Mt Gox (yeah, the btc one) that I've just left on my keychain all this time. My keychain is not treated gently, and it's been through the washing machine more than once... yet the hole is fine, and plugging it in now, it still functions and delivers its gibberish after a touch. I don't know what the expected lifetime should be.
I can't really speak to other people, but I personally avoid adopting 2FA because 1) most of my passwords are strong 2) it's not true 2FA, instead of yubikey it's some shitty SMS system or more uselessly a TOTP system whose key I can add to a bash script that'll use oathtool and xdotool to enter it for me with a hot key press 3) it's some shitty app that requires my online smartphone 4) I worry about the opposite case where services are so forgiving to restoring access that even if you have a brain aneurysm and forget the password and your yubikey bursts into flames they'll still let you in after a phone call -- if my account access can be socially engineered that way anyway, I don't want the additional annoyance of dealing with 2FA.
My brother got kicked off Facebook a couple weeks ago because his account was hacked and they couldn't decide who was legit and who wasn't, so they just threw up their hands and shut down his account. It hurt because he used Facebook a lot.
I agree that 2FA doesn't solve the problem of companies deciding not to invest in good, considerate, human, security conscious, customer support. More technology isn't always the right answer, especially when it comes to questions of companies harming and then dehumanizing their customers because it's cheaper than doing than the right thing.