I cannot speak to how accurate your description is, but this description sounds like there are multiple weak points and multiple attack vectors that open this up to increased risk of compromise, undermining the very security stance it's supposed to provide.

The spec is quite thorough and well thought out in this regard. Despite what it "sounds like" when described, it is very secure, even with a variety of implementations. What is far weaker is that most sites that offer passkeys also offer a multitude of fallback recovery options.

See my response above... I believe the description is incorrect, and bluetooth is required to prove physical proximity.