These sort of articles should definitely mention webauthn/passkeys. It's the only solution that actually solves these (including phising) problems.