It seems to me that Touch ID is slightly less secure, given that it stores your fingerprint on the device and you rely on the Apple module and crypto to be implemented securely.
With a Yubikey, the only thing you have to do to stay secure is to not lose it or let others use it.
The attack surface is larger but it's still not an attack almost anyone needs to worry about - a 0 day on the T2 (which has never been publicly found/reported on) is something only worthy of nation state attacks on other nation states.
