In that case, any of the vulnerabilities you mention still apply to Yubikeys since they're inherent to the OATH TOTP protocol, not to the platform that runs it.PROTECTIMUS SMART OTP Authenticator Support Number, PROTECTIMUS SMART OTP Authenticator Helpline Number, PROTECTIMUS SMART OTP Authenticator Toll Free, PROTECTIMUS SMART OTP Authenticator Customer Care Number, PROTECTIMUS SMART OTP Authenticator Customer Service Number, PROTECTIMUS SMART OTP Authenticator Support Phone Number, PROTECTIMUS SMART OTP Authenticator Tech Support, PROTECTIMUS SMART OTP Authenticator Phone Number, PROTECTIMUS SMART OTP Authenticator Customer Support Number, PROTECTIMUS SMART OTP Authenticator helpdesk, PROTECTIMUS SMART OTP Authenticator Technical Support Phone Number. But as OP said in their post, Yubikey support OATH TOTP just like Google Auth, and some people have to use it since many websites support TOTP but don't support FIDO. You can say it won't happen with FIDO, which would be correct, or with Yubico OTP or HOTP (for replay, both of those can be phished). Phishing is just 'give me the code so I can use it and you don't use it at all. You're talking about some sort of branching MITM attack. Phishing would basically just take the code instead of you using the code.

Phishing is a common scenario where this might happen. A good one will not allow the same code to be used twice and will force you to wait until the next 30 second period to access the website again.

This depends on the website/relying party. There is potential for replay attacks with TOTP codes.

Yubico authenticator