What get exposed if a malicious actor knows my master password but not my 2FA?

Doesn’t this type of hardware key from Unicredit bank offer the same protection as the Yubikey?

Quite right?

What are the differences?

Thanks so much!