It sounds like the report glossed over a rather important bit of ux: If, when logging in, you see a big modal dialog asking if you want to grant webusb access

It sounds like the report glossed over a rather important bit of ux: If, when logging in, you see a big modal dialog asking if you want to grant webusb access to the site, then DONT select your yubikey out of the list of connected USB devices and click "Allow". As long as you can convince yourself to avoid taking that particular unusual action, it sounds like you're fine.