A security key like Yubikey is the safest 2FA option. Theoretically a hacker could gain access to your software 2FA authentication account, but a Yubikey requires physical access to use something a hacker can't do. It also has an authenticator app to use 2FA on websites that don't support using security keys. The Yubico authenticator app requires the Yubikey to use, so it's safer than using 2FA apps like Google Authenticator or Authy.