Why not for normal users as well? I suppose that would make sense, just not needed for our users since we link their Yubikey to their Duo account so the key can generate the OTP.
This would be a great addition for, at least, customer portal authentication. In some cases we want a physical token used rather than app-based OTP.