Allow the user to set the default 2fa, with the effect that the default 2FA is displayed first. I use 1Password password manager. For Proton, I use both a security key and an authenticator. Proton insists on prompting for a security key and showing authenticator as an alternative. I almost never use the security key; it is my backup. But this behavior by Proton, prompting for the security key, prevents my password manager from getting me logged all of the way in automatically.

I currently have to click the authenticator tab. When I do that, my password manager takes over again and gets me in.