So I need to pay for the privilege of having a single point of failure for my credentials :)

Oh no I forgot, I could pay even more to have backups.

It's an open specification. You can make your own if you like.

If the security properties of a hardware authenticator aren't important to you, you don't need to use one at all.

A phone is also a hardware authenticator in this case. With the same problems in case of theft/destruction.