How do you securely register a second phone/computer? You should ideally be signed into the site on that second phone/computer to register it, which is what the QR code helps with. Once signed in, you can then securely register a key from the platform authenticator of the second computer.

After all the idea of passwordless authentication is to not even have any password as a fallback. If you do have a password based fallback, then obviously you can use it to sign in to register the new device, but since WebAuthn is far more secure than a password, the preference is to not have such a fallback. And of course, an account recovery flow based on emails or SMS and possibly "security questions" are almost worse than a password.

The QR code is far more convenient than needing to buy a fido2 security dongle, especially one that supports USB-A (for most desktops/laptops), USB-C (for android/iPad/other laptops), and lightning (for iPhone), so you can register it via any already registered device, and then use it on any other device for initial sign-in.

You apply with the untrusted one, sign in with the trusted device then approve the untrusted one. Same way as you add another fingerprint to a device for example by providing an already trusted identity.