A good fourth option would be support for physical security keys. These are what have superseded traditional recovery keys in most contexts (which is what the QR code sounds like to me from your description).
Yes, physical security keys are another factor we’ve spent some time thinking about - we’ll potentially explore supporting these in a future iteration!
For our initial release, we wanted to focus on shipping controls that 99% of our users would be able to understand and use on day one.