A trojan would succeed in using your session and potentially start sessions from your device in cases where your key does not require your confirmation or where they have found a bug to bypass that (it maybe as simple as providing simulated input events to the system).

My point is the gains are overstated the main weakness is almost always user action. Passkeys will not magically solve all our security problems.