As per the statement (and earlier statements) you can't change the firmware unless you have a yubikey neo developer edition, which was only sold during 2012 and 2013. The change here is that the yubikey 4 doesn't run open source code (for the pgp part) as a result of changing platforms. The best way to show that you support open source is to buy the YubiKey NEO instead of the YubiKey 4.
YubiKey NEO isn't a unique product, it's basically a cardreader and a java smartcard all-on-one, but there are plenty of vendors for both, it will probably can be even cheaper in some circumstances/regions.
If you support open source, then give https://github.com/philipWendland/IsoApplet a look instead.
A separate cardreader also means that you can use several smartcards for various things.
I was pretty close to getting a Yubi, until I realized that the default version couldn't modify the PGP applet, and didn't find exactly where to order the special "developer edition" either.
At this point it probably makes more sense to find/make a dongle based on an STM32 or the like. The problems with non-hardened hardware discussed in the article are real, but I'd bet the features/innovation enabled by a Free design will outweigh those tradeoffs (eg an audit log, indication of what you're signing/unlocking, actual encrypted key material when the device is "cold").
To me it makes more sense not to do crypto yourself, but trust in an established technology, which is a smartcard. They are used everywhere from sim cards to chip-and-pin credit cards.
If you read between the lines of how it went from closed, to very open, to less open, to now not open at all. It seems like they tried open source but failed. They were probably looking for people to integrate it into some e-mail client, chat application or even bitcoin wallet. Now they've gone back to focus on their core customer and using a cheaper more integrated chip.
> just don't be surprised when they discontinue the NEO.
I'd say that Yubico isn't a big deal, therefore them discontinuing NEO isn't a big deal either.
NXP is just one of many vendors, they sell blank java cards too.
EDIT: $25 shipping fee is very inflexible.
https://github.com/doc-rj/smartcard-reader
https://play.google.com/store/apps/details?id=com.inoapp.car...
Other than that there are java cards in microSD format such as these
https://news.ycombinator.com/item?id=9625862
http://www.cardomatic.de/epages/64510967.sf/en_GB/?ObjectPat...
Then there's also a shaky area of pkcs11 proxies.