> Whenever I've written authentication, passwords are hashed on the client side and never transmitted in the clear.

While rare, a couple of sites which has many (>1000) users have sent me my password in the plain when I told I forgot them.

Many sites have e-mailed my password in the open when I registered, as well.

I don't defend passkeys here, but too many weak links are present in password based flows today. If someone uses per-site strong passwords, one can contain the leaks, but use the password even once, and the problem grows exponentially.