This is a niche case that is already handled more or less properly by the BigTech.
Are you suggesting that people will change their passwords after they created an account and realize that it needs a better level of security?
Because I would argue that Collection #1-#6 proved the exact opposite: Humans reuse passwords, and invent sequences or suffixes when forced to change it.
So I get to be punished because of incompetent military contractors?
Opsec is about reducing risk from one potential breach to not affect other parts of your life.
Assuming you never made a mistake in your online life is a foolish assumption.
Which, you have to admit, is the most secure option. All security measures represent a tradeoff, and sometimes that tradeoff is not worth it.
That to me is the problem with Passkeys. They are not an unambiguous win.
Guess what their password was: solarwinds123
So yes, I am in favor of passkeys everywhere because humans are bad at realizing their operational risks when they start creating an account and haven't even used it yet.
Without password managers, humans tend to reuse their passwords, which makes one breach a breach of all accounts. Humans are also bad at remembering passwords, so time based recreation of passwords will always lead to the month or week or iteration as a suffix.
And that's the actual problem that can be prevented with passkeys (or MFA that is not based on sending SMS or emails which are unencrypted as a transport channel).
But I agree with the author's implied sentiment: export/import should work between password managers and be required by law, because currently Microsoft's authenticator workflow is pretty useless if you can reset the passkeys via email ownership anyways.