>> Only one specific device can ever login

> That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

Unfortunately, given the laziness, incompetence, and cost-consciousness of organizations like traditional financial institutions, telcos, governments, etc., many of them have & will end up with that implementation.