And then the moment you authenticate, the fake sudo still executes its payload.

Yubikeys do not fix this issue.