your phone, but the complaint in the original article is about those who don't use great security practices, which is most of us. Passkeys limit the attack surface to just your phone. With passkeys, attackers can't get your password (that regular people reuse everywhere) from some weak website or from phishing and then use that to impersonate you. We must go to something like passkeys.