[fragmede]

Yubikey offers a false sense of security in that regard, unfortunately, because if your device is thoroughly 0wned and you don't know it, the attacker "just" has to wait for the victim to do something that would trigger the yubikey, and then swap in their forged request instead. Eg if the victim uses the yubikey to log into bank1 and to crypto wallet, but bank1 accounts have no money, instead of waiting for the customer to log into their crypto wallet with the yubikey, the attack software waits for the victim to log into bank1, but swaps in a request to the crypto wallet instead.

[jdmoreira]

Not sure I understand your point. Under WebAuthn / FIDO2 you can't impersonate a RP

Could you explain better?

[gzread]

If the user's computer is pwned, you can wait for the user to log in to their bank account, then blank the screen while you send yourself all their money.