If the adversary gets root access to the workstation, they can verify at will. Removing the key, even just to place it next to the screen, prevents this to some

If the adversary gets root access to the workstation, they can verify at will. Removing the key, even just to place it next to the screen, prevents this to some degree and only allow the verification to happen while you're using the computer. But I still believe that proper 2FA require you to physically push a button on the YubiKey for it to give out keys. That enables you to control completely when it provide keys.