Should h/w MFI Auth be first choice?

Perhaps this is a question best put directly to your MFi contact, directly.

Otherwise, I can't imagine something as mundane as a chip in this example being 'scarse', just that they aren't free, and any excuse to reduce costs is always tempting to entertain, no matter how reliable it may be.

Keep in mind you have a proven process that you can leverage ROI on. Don't leave that investment on the shelf.

We had trouble acquiring the most recent version of the MFI Auth chip since there was a shortage when it first launched. You never know for sure, but the supply chain for these chips is stable right now. Our main reason for using the chip is to reduce software development time. I think the best approach here is to make a space on your PCB for the chip, and then you have the option to include it or not depending on your situation.

The rub with chip based security is that if the security model changes, your customers are stuck with a hardware solution that becomes potentially incompatible.

With a software based solution, which I believe requires a server, then you relegate your customers to having to let the product talk to the public internet and having the public internet available at the time of setup. If your product works well on a closed network normally... not a good turn.

We decided on hardware. This puts the onus on Apple to maintain backwards compatibility.