Like 99% of people in this thread, you are conflating distributed non-device-bound credentials (passkeys) with hardware security keys.
If they can be distributed they can be stolen, right? I don't see how it's any better than a password manager at that point.