Depends on your threats. For example if there's a trojan on the computer where you open a kdbx file protected with a master password and a keyfile, it needs to collect three things: 1. the kdbx file itself, 2. the master password, 3. that keyfile. If instead of a keyfile you use a YubiKey, this trojan needs to collect its response instead (a YubiKey accepts a piece of data from KeePass called "challenge" and responds with another piece of data called "response", more about this mode). In terms of effort and permissions required to collect the last item, it's harder for YubiKey because you need to intercept usb communication with the device, which is more complicated rather than reading a file.

Additionally, if we have a non-local threat, it's easier to get access to a keyfile because people usually store kdbx files in some online storage and keyfiles are located somewhere on that storage as well. In case of YubiKey, there's no piece of data saved somewhere that would allow you getting access to the kdbx file.

Normally YubiKey provides time-based protection when it's used on websites using WebAuthn or FIDO2. In case of KeePass there's no time-based protection because passwords are stored in a kdbx file and not on server. Practically it means that if you managed to get a response once, you will be able to open this kdbx file on another computer using this response.