They hold no value precisely because they don't store them and send you a magic link! If they stored a recycled password or its hash, then it would be valuable.

Yes but I use separate passwords and webauthn is per domain as well.