This appears to be using the PIV "smartcard" applet. I believe one option on each certificate in the PIV applet is whether or not a "button press" is required

This appears to be using the PIV "smartcard" applet. I believe one option on each certificate in the PIV applet is whether or not a "button press" is required for its use. I believe it is recommended that the device attestation certificate at least is not guarded by the button press. The threat model for yubikeys is to prevent the key being cloned - if it's in your pocket, it's safe. If you plug it in, and authenticate by PIN to the PIV applet, and push the button when prompted, someone may be able to generate a signature.