Flashing firmware makes it easier to compromise an unattended hardware key but as I said above every hardware key could be considered compromised in this sense. Pre-order generally come with stipulations on when you receive the product and what it will be. NitroChat is them running a Matrix chat server for you, they probably intend to have integrations with their Nitrokey. The SDK mentions that it is "Offered in partnership with Hardware Security SDK by heylogin GmbH", the intend of heylogin GmbH is to charge you for commercial use of the SDK. Them having less than 20 employees makes sense, it's a niche market.

What it comes down to is that YubiKeys have better integration but Nitrokeys are more fun if you want to hack on them, and it's not really a matter of security. Note that smart cards in general can be used for the same purposes, e.g. Java Cards. USB keys do not require you to carry around a card reader.