I think you missed the part where he's not combining something he has (the Yubikey, which stores part of his password) with something he knows (the other part o

I think you missed the part where he's not combining something he has (the Yubikey, which stores part of his password) with something he knows (the other part of his password). He needs both to log in.