Google quietly discontinues NFC Smart Unlock without explanation
betanews.com
betanews.com
Anything that uses a challenge-response protocol would be safe, but that’s not NFC tags at all. Google is removing a feature that can be used to break into your phone as easily as if you’d printed the PIN on a ring in Courier. Phew.
An attacker could use NFC to sniff the exchange between your phone and your Yubikey, so you're still vulnerable to eavesdropping. But the point of the challenge-response protocols is to make eavesdropping irrelevant.
The practical vulnerability would be if an attacker eavesdropped on a one-time password going over NFC, blocked your phone's outbound signals so that it can't send it, and then somehow used the one-time password for their own nefarious purposes.
You'll have to make your own judgement call on whether that's a level of compromise you can accept for your use case.
No lock screen password is safer than NFC, because it's more difficult to unlock your phone. Getting a physical hand to unlock your phone is more difficult than transmitting an NFC unlock signal to it from a distance.