how do I back it up and transfer it to a new device? This is relevant because an attacker can also do that.

Buy a new iPhone. Sign into it. Everything is now available.

That is the reason: for the average Joe not having exportable passkeys is good.

Average Joe doesn't have to do backup. It is all automatic.