Except that passkeys are treated as both a password and token at the same time. They are the sole thing needed to access a website, so you are absolutely storing your credentials with a large tech company.