Recent changes login my Internet identity using Yubikey - Lowering security by much

I notice some recent changes in the Internet identity Login page. Now using the word ‘anchor’, etc. But also, while using Yubikey to login, the system used to ask me for my digits PIN number, and then asking to touch the key. Now, it does not ask to enter the PIN number and only ask to touch the Yubikey. This reduce the security by much. I tested and anyone who touch the Yubikey can login in my account. Anyone who would access my computer can now enter in my identity apps, delete device, do whatever they want… Really not good. Is this a bug from the update?