I'm pretty sure that poor passwords ("password1!") and password reuse combined dwarf basically all other password-related security issues, thus getting users to use a randomly generated password on every website is a magnitude of order more secure.

On top of that, in cases of XSS or a MiTM you've probably already lost and no password alternative will help you.

Webauthn is secure even in the case of XSS and Mitm, in the sense that the attackers still cannot access the credentials without user intervention. It tool a long time to convince me, too.

https://webauthn.me/introduction

True but mostly meaningless. XSS and MiTM allow attackers to take over and pretend to be the user after a legit user logs in. The attacker cannot store the credentials and use them later, but they have full access in the moment.