Right, if you phish the credentials to an account that is not protected by a passkey, one thing you can now do is set up your own passkey on it. That's exactly what passkeys would've protected the victim against!
The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.
The other articles you've linked also describe attacks against accounts that allow non-passkey logins, or attacks that require a compromised browser.