Security of damaged U2F key? [duplicate]

Question

This question already has an answer here:

• Are FIDO U2F keys (like dual Yubikeys or dual Google Titan keys) undermined by the Google account recovery process? 2 answers

U2F key is praised for its security features. But I am afraid of using something so secure that when it is damaged I couldn't access my own accounts. So I searched what is recovery scenario and for example Amazon describes it as following:

if you can't sign in with your MFA device, you can sign in by verifying your identity using the email and phone that are registered with your account.

Ok, so I could get my data without U2F, but then... the potential intruder would need no U2F too. Avoiding email/phone path was the whole point behind U2F device, right?

My question is as follows -- do I miss something or the case of damaged (true or false) U2F key is actually a weak spot? I mean either recovery is easy for user (and intruder) or it is hard/impossible for user (and intruder)? Are those only two choices, or there is some middle ground, where it is easy for the user but hard for intruder?

Answer 1

In most cases, you can configure OATH-TOTP access as a backup. Sometimes, you can also register more than only one U2F key.