Two devices which can get handy for those:

https://usbkill.com/products/usbkill-shield

https://github.com/cecio/USBvalve

Thats why ones password DB should also be saved encrypted one one or two external drives.

I didn’t read to much of the FIDO2 spec, so I can’t really compare.
But U-Prove can be used for state-issued E-IDs. Is this also possible with FIDO (including dynamically issuing attributes)?