All your arguments amount to "i don't understand why smart cards/yubikeys/etc exist when you can just use passwords"

No, yubikey in the fido/webauthn form protects against phishing/TOTP snooping and replay over the web. TPMs for luks don't. See the other thread about evil maid.