I think the negative sentiment towards passkeys I've seen on HN is about how bad the experience has been setting them up. If you are using a non-standard browser there were plenty of parts of the process that fell over.

> Are they conflating fido2 hardware tokens with “google owns your credentials, and you can’t back them up” passkeys?

Not sure why you say this, but perhaps you are conflating device-bound credentials (which aren't supposed to be moved between devices): https://passkeys.dev/docs/reference/terms/#device-bound-pass...