Passwordless authentication means removing the most critical failure factor from authentication: the human.
> I should not be able to steal a yubikey
This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.
> I should not be able to steal a yubikey
This type of attack is not based in reality; most attacks are done remotely from a location with limited jurisdiction and practically no repercussions. When there is no credential to phish because it's a hardware-backed cryptographic assertion, security is drastically improved. WebAuthN literally provides credential phishing immunity, which is by far the most prevalent source of account compromise today (see: annual Verizon threat report). It is so superior, I would even go so far as to share my password to, say, my Google account provided it is protected exclusively with a hardware authentication factor.