Then see #2: there is no way to prevent humans from actually performing detrimental actions, hardware keys or not.

This specific attack (and many others like it) would have absoultey been foiled by U2F or passkeys. These authors would have been incapable of giving the adversary any useful credential to impersonate them by the very nature of how these systems work.