I know lots of people that have their 2 factor auth setups on the same computer they are using to login. If you can compromise that computer, there's no additional "2fa" needed.
All it takes is some engineer that needs admin access for their job installing something.
Well, I think it's as simple as you say. Phones have completely taken over the market. The majority of people don't find any value in having another device that's only differentiating factor is that it isn't their phone. (You didn't mention headphone jacks).
It's just like portable GPS devices, electronic organizers (https://www.youtube.com/watch?v=qdeE_kiG5Co), electronic translators/dictionaries, calculators, alarm clocks, ...
Your point is good but I do want to mention that I still use a garmin inReach when I'm going to places that are outside of cell service range. It's basically meant to be used with a phone anyway, but I get some peace of mind from having a specialized device to do things like call for help.
I was actually thinking about MQTT after I posted this.
I'm leaning towards just allowing the mqtt server you connect to to be changed, so that you can point it at whatever in the future, and all messages are plain text and documented.
The problem is the auth is plain text too and you're open to having your credentials stolen.