(Security isn't my specialization, so somebody please correct me if I'm wrong).
My understanding is that two APIs talking to each other and exchanging one time tokens is better than the same APIs exchanging passwords. Passwords are susceptible to phishing attacks, rainbow tables, dumb password requirement policies, and also just basic fuckups like transmitting in clear text or not hashing and salting it.
Compared to time based software OTPs that 1Password also did, I don't see any security improvements there. But the user experience is better (one click instead of multiple).
Compared to gold standard 2fa (something you know AND something you are or have), I think passkeys are actually a downgrade. They wouldn't be if you used your hardware secure enclave as your key storage, but you can't do that if you want the convenience of cloud sync, so we're back to square one.
All in all it seems to me that passkeys primarily offer better convenience with good enough, not optimal, security. Which is probably the right balance IMO.
