Mobile Google account based is even weaker than hardware tokens used by banks. Make of that what you will.

Please give some evidence that this is due to hardware tokens failing where a smartphone based solution would have prevented it

If they use SSN as a password, it doesn't mean you can't have something slightly more reasonable without going full cyberpunk dystopia.