If someone has code execution in your browser, they can just steal your authentication cookies. They don't need your Passkey.

It's true that unsynced/hardware-bound credentials can help mitigate such attacks, but they cannot prevent it. The primary threat model of Passkeys is password theft via phishing, reuse, server-side compromise, etc.

If you want to use a USB security key, you still can--Passkeys do not take away from that. But most people are unwilling to go buy a USB key or carry one around, which is where Passkeys--arguably a bit less secure, but far better than the passwords they replace--are still a great step forward.