Comment by pshc

Passkeys only give a random public key + some capability bits, whereas almost all password logins ask for your email or phone number, for the inevitable reset dance likely facilitated over antiquated email or SMS. Realistically the latter is much leakier.