That QR code from a malicious website will not actually communicate with the malicious website with authentication from the correct origin, most QR code phishing scams do not actually use passkeys but rather fall back to trying to get the user's fallback login information (if any). By spec, if the domain does not perfectly match the domain where the passkey was originally created, the phone (or passkey provider) will fail to find a matching passkey. And the domain is derived, not provided by the QR code data (it's all in the spec).

Basically, it's very hard if not basically impossible to spoof a QR code to access the real passkey via a malicious site. (caveat, without already having compromised something like the user's DNS, maybe? Even then the site would likely fail the cryptographic checks.)