if somebody compromises you, physically, they can see everything you can log into

Can they though? I own a few yubikeys with passkeys stored inside and i cannot query stored logins without entering a pin.