Your desktop is also always connected to the internet (unless you're have very very high security requirements). And your desktop probably runs way more untrust

Your desktop is also always connected to the internet (unless you're have very very high security requirements). And your desktop probably runs way more untrusted code with less sandboxing. Of course a hardware key is more secure, but this seems like a meaningful improvement over normal key files.