The normal person will click the "Use password instead of passkey" link conveniently placed by the impersonator, who will then have an email address and set of user-provided password guesses that they can try on other domains.