A security key wouldn’t prevent spam since you can buy multiple. It would increase the cost of spamming, but it’s unclear of the relatively affordable price of security keys would love the needle enough vs attrition from legit users
You can buy more phones too, though presumably the phone companies don't sell bulk phone numbers for short term use and make it prohibitively expensive and time consuming to do so. Basically seems like it works by outsourcing those spam combating efforts to the local phone companies.
Security keys are typically $20, that seems pretty expensive to me if you are a spammer opening hundreds or thousands of accounts.
https://github.com/MattGorko/libu2f-emu can spin up virtual U2F tokens which are indistinguishable (in my experience) from real ones plugged into a USB port
WebAuthn deliberately doesn't give relying parties a way to tell if two registrations are from the same device.