The pin system implementation is terrible at least for Windows, because it forces you to make a pin but not all websites do that so it’s easy to make a pin for one website but not realize that if you forget the pin and misenter it 10 times it locks the key permanently and you have to reset it, but that deletes everything and so you can end up in a situation where the yubikey is on your site account login but you dont have it now and you can get locked out.

Website wants you to make a passkey, go to login but the entry form only accepts the user name, then you have to click next to password which may or may not accept the passkey.

But you can lose that hardware or it breaks very easily.