Thanks for the information. I never thought there was some kind of insecurity. Now I really thought about this question.
You’re quite right, I wasn’t thinking about II when I wrote that. In that case, you and I could meet at a location, and you could watch as I register your Yubikey to the II account, and then delete all of the other keys. You now own it completely. It would also work for transferring a neuron within the account, because there would then be a forced window during which you can safely confirm that you have complete control of the set of authentication keys.