Yep. Those are still prone to phishing for a clever attacker and sleepy employee. For most users - that should be fine, but for the ones with the admin access to the nuclear reactor, U2F/FIDO2/WebAuthn probably worth the extra effort.