Yubikey is not something popular in enterprises. At least not the ones I worked for. I only heard about it because Google uses it (or something similar).
My company uses Okta Verify. So when the bad guy tries to connect the hacked laptop to the corporate network VPN, the person who was assigned that laptop gets a "Login attempt, is that you?" message on their cell phone (if the push method is used) or is prompted for the 6-digit code, and it doesn't connect until confirmation is received. Unless someone can defeat it somehow.