Comment by swat535

If your account is already not protected by passkeys (it has access to traditional username + password credentials), it can be phished regardless.. in those cases you just need to send them a traditional "reset password" phishing email.

The point is that those attacks would be (nearly) impossible if you have a truly passwordless system.