Yeah. That's what I came here to say too.

Previously when their Yubikey 4's were found to be suceptible to the ROCA vulnerability [0], they issued replacements [1] for any customers who had affected devices. I had a few of those devices and they were replaced for free.

I guess that's a disadvantage of having a non-upgradable firmware. They can't fix these devices that are already out in the field.

[0] https://en.wikipedia.org/wiki/ROCA_vulnerability

[1] https://support.yubico.com/hc/en-us/articles/360021803580-In...