Ok, so the big security risk that passkeys are supposedly designed to stop, is actually still there?

If you can still be phished, remind me what the point of any of this was, again?