Explain how any solution prevents the user from opting out of yubikey and typing self-XSS into Dev console to get owned. Unless you have a 100% vendor control

Explain how any solution prevents the user from opting out of yubikey and typing self-XSS into Dev console to get owned. Unless you have a 100% vendor controlled system, (more than Apple + ChromeOS combine) you have to rely on the user not breaking their own security.