iCloud backup helped uncover a $320M crime ring in Brazil

You have to have some kind of recovery method, one of which I think is hardware keys. You can also just generate a recovery code which is what I did. I don’t remember it ever being the case that you needed to have hardware keys to enable it. You also have to have 2FA enabled on your Apple account but by default they just use your devices as the 2FA method, but you can set up hardware keys for that if you want.