Isn’t that a bug in the Microsoft software, not the pass key specification?
Attacks on passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.
Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.
It’s not a new vulnerability. It’s not a reason to roll out Passkeys unless it’s also a reason to get rid of passwords.
With Passkeys you’re still net ahead.