I kind of agree, the problem is not individual sites consuming passkeys.

The main problem in my mind is on the side of the vendors, attestation, secure hardware, etc is all an excuse to lock you in to their device/ecosystem.