Passwordless is actually MFA --
Something you have (your device) Something you are (your biometric)
Those are definitely two factors that are required to be together for passwordless to work
Something you have (your device) Something you are (your biometric)
Those are definitely two factors that are required to be together for passwordless to work
More than that "who you are" should not be used as a factor of auth but as a user id aka username. It identifies, it does not authenticate unless you can revoke it and guarantee it can't easily be reproduced.
Biometrics are very difficult to impossible to reproduce short of physical coercion.