Ok fine let's talk about why mTLS is hard:
1) Browsers have terrible UI around client certificate choice and picking the wrong one or hitting the wrong button breaks everyting
2) Issuing client certs is painful (not very important as far as token binding is concerned, you can just self-sign)
3) Hardware-backed client certs are slow (I think this is less true today)
4) If you have front-end proxies that terminate TLS you need to handle it there
What else?