The vulnerability doesn’t make sense though. Sure, someone can clone your YubiKey. But they can also just tap to log into any website they want without cloning it if they stole it.