This comment is accurate. Also, hardware keys can require biometrics or any other way of authenticating you. Currently, Yubikeys erase themselves if you get the PIN wrong three times (if I'm not mistaken on the number), so it's very hard to brute force.