This is missing an extremely important upfront concept: you need to know what you're protecting and how valuable it is. It does no good whatsoever to require every user of a grocery-list app to have a Yubikey to verify their identity. It might not even make sense to have users login at all. The balance between usability and security must be consonant with the costs of implementation.
Unfortunately, if you force users to pick between usability and security, they'll ignore security every time. Or as I often say "no one ever says, 'wow, that was a great login experience', they just want to get to the features behind that experience (hopefully securely behind it)".
People can make the right choice about security when they know what they are securing. Instead, online we are inundated with so much unnecessary security we start to have a prior biased towards: this isn't important. Back to the physical door analogy, when there are locks on every door even doors that really don't need them, people start propping open doors.