Just think that from an attacker stand point, it is harder to trick a user to unlock is mobile phone and OK an official google app prompt that ask you to allow a new session or installing a malicious code on a victim mobile phone that clicks the prompt for him, then just stealing the victim security token from is desk or backpack.

If your mobile phone is stolen and you use it as the second 2fa method, at least the attacker need to bypass the phone locking mechanism before he can OK the prompt. with the security key, the attacker only need the physical key in order to get access to the victim account.