No, they can't. You could try ro replace passwords on your service with some stupid id verification scheme, but you have not extended passwords.

This is not true.

How? It wouldn't be easy at all it would be totally unconventional and break all sorts of expected workflows for passwords if you had to take a photo every time. For example at my work we have a ton of computers and none of them have webcams.

Passwords are client-neutral. Passkeys aren't: you can force a certain client, and now those clients can force an OS through attestation.

It happens now with 2fa today. I have gone through college for 4 years having to use this shitty duo mobile app and we have to take out our smartphones 20 times a day to do things and re-login after every 20 minutes.