And when they don't? What then?
One of the biggest issues with the implementation of passkeys that I've encountered is that I'm not offered the choice of where a passkey will be stored. It's just a fight between my password manager, my browser and my OS which all try to be "first" to intercept the passkey request, and if the "wrong one" gets it there's no way to say "actually no, I didn't want you to handle this passkey request".
This is one of my biggest issues. My family full of normal people are nothing more than dark pattern victims. And if you teach them to avoid certain dark patterns, big tech is quick to update them.
The whole industry is turning into one big scam.
If I have to explain Passkeys syncing from her PC where she made the account, to her phone, then to the 3rd PC using some qr code or bluetooth, then we're both gonna lose it. There is value in passkeys, but there's also huge value in a stupid and slightly less secure password that we've just completely abandoned.
Have all your mails at Google, ship stuff home with Amazon, but your authentication mechanism is a trap and anti-privacy?
My company's product uses passkeys-only and it works great. We don't need to store user's email addresses if they don't want to. Because we don't need a password-reset flow. Because passkeys usually sync and backup. And if you really want, you can have multiple passkeys for your account (or multiple accounts).
I don't see how we could use passkeys as a trap. Our users find it convenient and the security properties speak for themselves.