Yubico specifically addressed the problem of BadUSB in their blog post from August 2014 confirming separately capabilities of each of their products:
- FIDO U2F, YubiKey Standard, YubiHSM are not capable of having their firmware upgraded;
- YubiKey NEO supports firmware upgrade, but requires the new firmware image to be signed by Yubico;
- neither of the devices contain memory capable of storing malware code;
- YubiKey 4 released in November 2015 is not mentioned.
Yubico is aware of the problem and claims to have taken precautions against the attack (in case of devices technically capable of having firmware upgraded).
Unless Yubico breaks their promise by either a flaw or a change in the aforementioned policy, there is no way to alter the firmware in YubiKey without a physical intrusion.
The ultimate decision whether to trust Yubico as a provider is on the user.
Regarding the quoted entry from the Yubico FAQ, it's full content is:
No, It is currently not possible to upgrade YubiKey firmware. To prevent attacks on the YubiKey which might compromise its security, the YubiKey does not permit its firmware to be accessed or altered.
Yubico is dedicated to providing a long-term two-factor authentication solution, we want your YubiKey to remain useful for the full extent of its lifetime. When we do release new firmware, we ensure the new YubiKey will function the same as older versions, so there is no need to purchase new YubiKeys to ensure compatibility.
The first paragraph means YubiKey firmware is non-alterable.
The second paragraph means: when Yubico releases a YubiKey with an updated firmware version, they ensure the compatibility of the supporting software with the old devices (which are not upgradeable).
There is no room for interpretation or speculation.
