They always neglect to mention that you can't (unless something changed recently) upgrade the firmware. It's carefully crouched in wording, but to read the site you'd say "Oh, so I just upgrade". No, you buy a new version of the device. And hopefully it's not like the last vulnerability when at least for a while they kept selling the vulnerable devices to deplete their stock unless you knew enough to ask for one specifically with the new firmware.

I believe in, and am a big proponent of physical 2FA being widely adopted -- though I own a half-dozen YubyKeys, I do wonder what their profit margins are. They feel a lot more expensive than they should be.