They are pointing out that while the "something you have" factor may be stronger than "something you know", multi factor is still better. I agree. Also, passwords are decentralized, whereas passwordless puts the power into fewer hands, so this too reduces complexity for attackers.

2FA>1FA