PayPal for sure, because at one point they actually removed the ability to use a hardware mfa token.
A little known fact about iCloud is that you can use hardware MFA tokens. I think this feature was just recently released though. They force you to enroll at least two tokens too, which is a nice safety. I set this up about a month ago and it's been great.