This was roughly the state of affairs before but the state of things have relented where software password managers are now allowed to serve the purpose.

So if a hardened security guy wants to only use his dedicated hardware token with registering backups, that’s possible.

If a layman wants to use Google password manager to just take care of it, that’s fine too.

Also much in between, using a phone instead of a yubikey like, using an offline password manager, etc.