FIDO2 is effectively a passwordless login system. Plug in your hardware key and you’re logged in. Isn’t this much less secure considering all someone has to do is steal your key?

Sorry if this is too obvious of a question, but I haven’t found an answer to it anywhere.

One place mentioned that it wouldn’t necessarily be for the primary login but just for reauthenticating a timed out session, which sounds reasonable though it isn’t advertised that way.