"full access to your USB stack" is not very meaningful (and honestly sounds like a WebUSB criticism, maybe someone thought U2F required WebUSB?!) You only have

"full access to your USB stack" is not very meaningful (and honestly sounds like a WebUSB criticism, maybe someone thought U2F required WebUSB?!) You only have access to the devices which you have permission to access. On FreeBSD, we have a devd config that sets the u2f group on U2F tokens.