App based 2FA is still more vulnerable to phishing than a U2F key, because it relies on the user to check they are entering the code into the right website.
It's also faster and easier (no pulling out your phone, getting a code, typing it in, just touch the key).
Plus, the keys have other features (GPG keys, etc...) which can be useful.
That said the cheaper yubi do this as well. I use my yubi 4 for securing my ssh key as well though this is a) a pain & b) likely theater.