Phishing protection: HUGE win for the token.Google Authenticator (or other TOTP app) as second factors. On the other hand, let's do an apples-to-apples comparison, and consider a Yubikey (or other FIDO2 token) vs. Besides, if you really want to, you can require a passcode to unlock the private key in the Yubikey most software doesn't do this, and I suspect some doesn't support it, but the token itself does. I would argue that, in most cases, 2FA using password+TOTP authenticator app (on a separate device) is safer than 1FA WebAuthN using a Yubikey. It's a popular choice for a second factor, but by virtue of being a second factor, it's completely useless without the first factor (typically a password) too. Nobody (that I've seen) uses an authenticator app as a single factor. In other words, you're really doing an apples-to-oranges comparison here. To get into them, you need my Yubikey (or a recovery key) AND my password. There's literally nothing you can log into using only my Yubikey it's the second factor I use on a ton of stuff (password manager, VPN, GitHub and Google and a bunch of other web sites / SSO providers, etc.). Using a Yubikey (or any other FIDO2/WebAuthN token) as a single factor is an option, but you certainly don't have to use it that way.

Yubikey alternative open source