Except that passwords at least protect you if your hardware key is stolen. Using just a hardware key seems similarly risky to just using a password.
Emphasis added. Device needs to be paired with Company's AD first.
I also imagine that there are options for making e.g. the device unlock only require yubikey, but login to SSO require 2nd factor.