If there is a recovery mechanism that isn’t horribly annoying and secure, the yubikey is worthless.
At this point the YubiKeys only provide some measure of convenience. It's disingenuous for the blogpost to paint this as some meaningful security improvement if Okta Verify is the fallback. Feels like such a waste of time and effort to build something worthwhile and then undermine it just like that.
You need to have a reliable and secure backup if you want to deploy yubikeys - or limit accounts that have been recovered until they’re revert fixed.
I don't use any methods other than YubiKey when I do have my keys. So attackers cannot trick me. If I see a choice without Yubikeys I immediately know I'm being phished.