Comment by PennRobotics

The normal person will click the "Use password instead of passkey" link conveniently placed by the impersonator, who will then have an email address and set of user-provided password guesses that they can try on other domains.