They’re using the same standard as FIDO2 / WebAuthn hardware security keys. The protocol is phishing resistant, unlike TOTP and similar one time code solutions.

I prefer the physical ones, because they’re easy to organize. Passkey synchronization can be annoying.