Well I imagine in most people's cases if they've managed to compromise their email then the game is already won. Anecdotally, someone got my steam account cred

Well I imagine in most people's cases if they've managed to compromise their email then the game is already won. Anecdotally, someone got my steam account credentials. I discovered this when they tried to change my password. Fortunately I had Steam's two-factor enabled and got the notification (2-factor is required to change steam account passwords), which alerted me to change my password. They actually tried the account recovery option and I got an email notification about that as well. So in situations like that such notifications can be quite useful. But yeah, if they've compromised your most critical accounts/devices then YubiKey isn't going to save you. I don't think that's a knock against it.