I mentioned this in a different post but I use both my password manager with totp as well as a YubiKey as authentication methods as I always have either my keys or my phone.
As for the recovery codes, SanDisk flash drives come with a password protected vault program that I put them in, then put that flash drive in my fire safe. Maybe not the most elegant solution, but it’s worked for me so far.
I use a YubiKey and I like it. At this point the bulk of my 2FA is in ProtonPass, but for my work Microsoft 365 and Duo specifically it’s nice to default to it and I’m more likely to have it since it’s on my key ring, than my phone. Also nice to have stuff pointed to that rather than an app if you like to upgrade or wipe your phone frequently.
I think most businesses that don’t provide work phones should be getting them for their employees so they don’t need to require that employee install an app on their personal device.
I don’t know what kinds of packets WiFi calling sends, but I would assume a public IP would be in there somewhere and, at least from a law enforcement perspective I can’t imagine it would be too hard to get the address tied to it.