Ah, yes, this is true. One option is to use that as just one authentication factor, and revoke it if it is lost. One could use it with a password, as is common

Ah, yes, this is true. One option is to use that as just one authentication factor, and revoke it if it is lost. One could use it with a password, as is commonly done, but you could imagine combining it with a key stored on a server, making it a two-layer key system. That way, extracting the key would likely be of no use to someone who stole it, provided you can revoke access quickly enough. So yeah, hardware security measures can be useful, but do not necessarily need to be 100% foolproof.