>that synced passkeys should be secure in even in situations involving compromised clients?

I think that is the idea actually. By using secure hardware features it is in theory possible to secure the passkeys even in the case of compromised clients. Like how the iphone uses a security coprocessor to store the decryption keys and face id info out of the reach of iOS.

But this isn't overly concerning since it's still at a minimum as secure as passwords in a local compromise situation.