[traceroute66]

> shell access with a touch based key just means the attacker has to wait for you to auth

And if you want to be EVEN more pedantic, on most touch-based keys, you have to touch within 10–15 seconds otherwise it times out.

So it is not a waste of effort at all. First the need to touch at all eliminates a large chunk of attacks. Second the need to touch within 10–15 seconds eliminates a whole bunch more.

There would have to be some heavy-duty alignment of ducks going on to get past a touch requirement.

Even more if the target has touch AND PIN enabled.