Passkeys are an origin-bound login mechanism. Worst case is that somebody places a first-party cookie to keep you logged in after you authenticated with a passkey. which they and will already do today without your consent or without logging in. (First-party session cookies don't even need a cookie wall. They're considered "necessary" processing)
Hacker News, for instance, allows non-logged-in read-only usage. If Hacker News decided that Passkeys were so easy for the user that non-logged-in usage would be eliminated, then some degree of privacy would be lost.
Personally, I don't think it is that much of a risk. I DO worry about putting too much control in the hands of Apple and Google.
Not if you the user generates a new login upon every visit, which should be trivial.
Tracking you via your email address is actually better than using cookies (for the advertiser) because it works cross-device and cross-browser.
Any mechanism that makes it easier to login to sites will promote the usage of email addresses for tracking purposes. Think retargeting and conversion tracking (no longer needing to be cookie-based).
Passkeys = quicker and faster to get a user's email address.
Email address = even better than "super cookies"
At least in the EU, you'll need express consent to do this.
From personal experience, businesses I've dealt with in the EU are eager to be compliant as long as it's applied across the board (ie, they aren't losing their competitive advantage).
Using passkeys doesn't give a site your email address. The site would have to still ask for your email separately.
If more websites require logins, they can track you more easily, simple as that. It has nothing to do with the engineering aspects of passkeys, and everything to do with the fact that technology which makes logins easier will encourage more login-based services.
You need to step away from the engineering details and look at things sociologically.