> Even if someone stoles your password database file, it won't work as the attacker needs your Yubikey too.

It's the same with any password manager. The issue is, after someone somehow had one peek at the decrypted data, they have all the TOTP seeds they need so they no longer care.