Because it prevents an attacker from stealing the password. It's both extremely hard to "steal" a passkey, and to phish a login from one. Neither of those are true for passwords, and TOTP only partially solves the stealing part.

Passkeys aren't solving for security nerds who like portability and have 30 character long passwords, they're solving for grandpa who will happily read their bank's 2FA SMS to the "bank" over the phone. The FIDO alliance has literally billions more of these users than they do users who know what hardware attestation is and how it impacts their auth workflows.

We don't need attestation and most of the data bits. Apple consumer devices don't support attestation. Only Apple enterprise managed devices do. It's a paranoia tool for big enterprises with strict device management requirements. Apple has a lot of good reasons to believe attestation is a privacy violation for consumers and seems likely to keep up the good fight in making sure it remains an enterprise-only tool.

So companies can use passkeys and set policies around what hardware they're stored on. IMHO, not particularly useful or desirable for everyday Internet users, but really nice if you have specific requirements.

So that our device vendors can say:

> I attest that this user's advertising ID is 12345, and for a fee I'll tell you all about what they've been up to.

Think of how much money they're just leaving on the table by letting us authenticate in ways that don't create such a side channel.