But this is one of the points being discussed here. All of depends on a large number of choices that each site owner will have to get right. You could always argue "well, it's the site's fault for not doing it better", but the matter is that the site owner has to decide those things at all - and if course they will make their own tradeoffs or simply don't bother with certain features.
So you will always have a wildly inconsistent mix of different functionalities and constraints depending on the preferences of the individual services.
Whereas with passwords, implementers don't have to do any of those choices, the basic implementation already supports all those usage scenarios.
The QR code login flow is one such example. I probably have some bias that I don't like the thought of making my phone the sole authority for all my accounts, but even if you accept that, it's an exotic technically complicated flow for the exclusive usecase of "login on untrusted device". There are probably few sites that weigh that usecase high enough to implement the flow - whereas with passwords, there is nothing you have to implement, because the functionality is just a natural consequence of how passwords work.