[c2352466]

Attackers will just use the JTAG/Debug port and be done with it. They probably didn't even give it a single thought whether there is a vulnerability to exploit in the opensourced firmware.

The YubiKey NEO was always "unsecure" now with the YubiKey 4 it's only possibly "unsecure".

[amluto]

I think you may be reading the OP wrong. The YK NEO used a secure element chip, too.