[whitepoplar]

My guess is that it's related to support costs. If you lose your hardware key and fail Google's automated account recovery, that's a feature! If you lose your Dropbox hardware key, I'm guessing they have a proprietary recovery procedure that's not regulated by a government. If you lose a key that's associated with your bank account, that bank by law must still give you access to your account, and support costs to do that are likely higher than the systems they already have in place. Or maybe it's just hard to add this to aging infrastructure held together by duct tape, dunno.