Yes, the PIN is optional even on Yubikeys, although I think individual providers can require it. Ideally a strong PIN should be used but people may just reuse their ATM PIN, birthday, etc.

I didn't realize PIN was optional.

See my other comment re: the IT industry being fools.