That’s why you assign all of them random names which are recorded in a separate BitWarden store. That one only opens with a password which is “YUBIKEY”.

One can use the TPM so at least the secrets can't be mass exported. Doesn't stop keylogging individual ones of course (but a browser extension might).