Why do you think this USB token alone is securing the laptop?
This is a two-factor authorisation situation. For those who've not met the concept before, 2FA is described as "something you know, and something you have". The USB dongle is the "something you have", but the laptop is still protected by the "something you know", i.e. a password. 2FA is intended to add a layer which allows one factor to be redundant, so it doesn't make the system insecure if the attacker gets the security token, so long as the user doesn't also have the password written down. Of course it's better that they don't break one arm of the security, but the laptop should still be secure if they do.
For forcing the user to remove the key, that also has a major issue. Securing the laptop is an afterthought, to protect any local files the user might have hanging around, which is a small subset of your company data. The critically important part is securing the user's access to your network. Networks, especially VPNs, are only as good as their login security. So if you're concerned about security, your VPN should be checking that the Bitlocker token is present when the user logs into the VPN and that it never leaves the machine during that login session. Otherwise the user could have accidentally left themselves logged in when they closed the lid and thought the computer was shut down, or various similar scenarios. You can't make the assumption "they logged in OK at some point in the past, therefore that is still them using the machine".
In short, I think you're over-thinking one area and not considering the bigger picture of how it helps company data security.
The simplest answer for USB dongles of course is to insist that they live on the user's keyring with their house or car keys. More than one keyring? No problem - they can have as many dongles as they need. But this ensures the dongle is always removed from the laptop when the user leaves it, because they need the keyring to get home.