Yes, keyfiles add some security. That added security may or may not be useful depending on the circumstances, but it's there.

A (properly randomly generated) keyfile has at least 128 bits of entropy. That's a lot more than a decently memorable password. With proper hashing, a long enough but still memorable password cannot be cracked in a reasonable time at a reasonable cost. However a keyfile is more future-proof than a memorable password.

More importantly, combining a password with a keyfile means that you have two authentication factors. (That's assuming you type the password rather than storing it in a file on the same machine, otherwise the password and the keyfile play the same role.) A password is “something you know”, whereas a keyfile is “something you have” — you have the storage media containing the password.

Multi-factor authentication is useful because different factors are subject to different threats. Malware running on the machine where you use the credentials is the worst case scenario: it can snoop on any credential you enter in any way whatsoever — and it can impersonate or subvert the application anyway, so you've lost regardless of what happens to your credentials. Many other attacks only affect one vector. For example, an attacker who steals backup tapes can obtain the keyfile but not the password. Conversely, there are many attacks that can reveal a password but not a keyfile, such as an shoulder surfing (possibly helped by a camera), or a hardware keylogger, or any other form of physical snooping (e.g. through sound or radio emissions).

Yes, keyfiles add some security. That added security may or may not be useful depending on the circumstances, but it's there.

A (properly randomly generated) keyfile has at least 128 bits of entropy. That's a lot more than a decently memorable password. With proper hashing, a long enough but still memorable password cannot be cracked in a reasonable time at a reasonable cost. However a keyfile is more future-proof than a memorable password.

More importantly, combining a password with a keyfile means that you have two authentication factors. (That's assuming you type the password rather than storing it in a file on the same machine, otherwise the password and the keyfile play the same role.) A password is “something you know”, whereas a keyfile is “something you have” — you have the storage media containing the password.

Multi-factor authentication is useful because different factors are subject to different threats. Malware running on the machine where you use the credentials is the worst case scenario: it can snoop on any credential you enter in any way whatsoever — and it can impersonate or subvert the application anyway, so you've lost regardless of what happens to your credentials. Many other attacks only affect one vector. For example, an attacker who steals backup tapes can obtain the keyfile but not the password. Conversely, there are many attacks that can reveal a password but not a keyfile, such as an shoulder surfing (possibly helped by a camera), or a hardware keylogger, or any other form of physical snooping (e.g. through sound or radio emissions).