Passkeys are said to be more secure than passwords that is why every service provider is pushing them. From Amazon to GitHub to Google and so on. But passkeys have a problem. If an attacker gets hold of the account and adds their own customer passkeys to the account then changing the password or passkey does not help. The intruder still has access to the account
If you think your account has been compromised, what is probably the first thing you do?
Change the password!
We have basically trained people for years that this is how you secure a compromised account. The problem is Passkeys change that.
Worth a read