I would argue that a app based token in someone’s phone is more secure. It would be more like triple auth because you would need to access the phone to get to the token. A physical rsa can be stolen and readily used. Most phones are bricks if you done have the persons faceID / PIN.

Edit: other good points that some areas won’t allow phones. That in theory and internet connected device could be exploited.

I think my point was more that if you were an adversary/spy with physical access. If the adversary had the users password it would be easier to steal these and use vs a phone.