If EA can't offer adequate account security without external devices and extra expense, they don't deserve our custom.
(and yes, there are many ways to increase security without requiring external devices: A second password, for example: The trick is the second password is never requested in it's entirety. Instead, two or three random characters from within the password are required, making it impossible for keyloggers to capture the entire password in a single login session).
An external security key is simply both an inconvenience and an unnecessary extra expense.