Whatever security system you have there is always a problem of original sin. This is when attacker happens to be present and prepared to hijack your initialisation process.
If an attacker has unrestricted access to your laptop or phone and you are trying to use this device to set up say your AWS root account, no amount of Yubikeys will help you. They can essentially craft everything you are seeing on the screen and intercept everything you are typing in. What they do with it only depends on their imagination but with the advent of AI powered tools I expect hacking tools are going to get much "smarter" very quickly.
A coworker lost all money he saved for many years for the downpayment on his apartment. He used his laptop to manage his banking and his phone to receive SMS messages. He logged in to his banking from his phone JUST ONCE. That was enough. Apparently, he had some kind of malware on his phone that was waiting in hiding for this exact occasion and the moment he logged in it intercepted the credentials and was able to transfer money out of his account with the codes he got on the same phone. It wasn't even targeted attack. And it was 10 years ago.
And as far as Yubikeys I would suggest they matter less than people think. They are useful concept but only if services providing MFA capability implemented it correctly. And as far as my experience goes, no large service I use at the moment implements this correctly.
The biggest problems are usually defaulting to SMS/email code if you indicate you've lost your Yubikey. Even for services that don't do this, there is usually some way to recover access anyway.
I have lost both my root password and two my yubikeys to my AWS account. Guess what, couple phonecalls later I got my access back. It was stupid for me to loose my credentials (but it was empty account at that time) but it is not inspiring confidence in me that anybody with just the access to my phone number and possibly couple scraps of personal information can recover full access.
My strategy right now is to compartmentalise critical services that I use -- use separate device to access them, never use my other devices for this, use separate email and separate phone numbers. Never reveal to anybody the email and phone number. Never put anything that could create any interest for those services, emails, phone numbers, etc. Yubikeys are nice gimmick (that I use daily) but I honestly don't see them as doing much for my security.