Why is Microsoft being a bully in regard to security defaults?

It's worse than you think, the latest "scrap SMS and calls, and then force auth app or passkeys" is a REAL nightmare!
Issues I can see from space, where to begin....
1. You use the Microsoft authenticator for MFA, and backup onto you cloud account.
    So when you swap phone, it will all be restored... WRONG
    The backup will NOT restore Microsoft accounts, you have to re-add them in the user security settings, which is a NIGHTMARE is you are the tenant admin and your MFA is your lost phone!

2. Passkeys cannot be backed up or transferred to a new device! 
    They exist only on the device, lose the device, lose access.

3. Only "solutions" recommended are to register multiple devices with Auth App and passkeys, they literally said "get two phones"...

This is just madness, the levels of user support for this will be wild, it is for normal MFA when the users mess up the backups.