18 additional bits of security means a bruteforce attack is 2^18 (262144) times harder. Quite a long way away from "16% more security". Yubico is intentionally

18 additional bits of security means a bruteforce attack is 2^18 (262144) times harder. Quite a long way away from "16% more security". Yubico is intentionally obfuscating their words here by talking about the percentage increase between number of bits of security so that people will walk away with this exact misunderstanding. There is argument to be made that 4096-bit RSA keys are unnecessary. But this isn't it.