corporate employees are typically regular people, and where phishing resistance is most valuable.

if by regular people, you meant "in someone's personal life", i would say phishing resistance is still relevant but agree that loss of access becomes a bigger risk to balance