I'm not sure I follow this point? A trojan would fail to exfiltrate passkeys (assuming they're stored securely). It would be able to see a valid login and potentially use that session or exfiltrate the session, but wouldn't be able to get persistent account access. This seems better than stealing a password and getting persistent account access, or possibly stealing a TOTP code for the same. It's bad, but I think it's made better by passkeys? Unless I'm misunderstanding your point.

A trojan would succeed in using your session and potentially start sessions from your device in cases where your key does not require your confirmation or where they have found a bug to bypass that (it maybe as simple as providing simulated input events to the system).

My point is the gains are overstated the main weakness is almost always user action. Passkeys will not magically solve all our security problems.

I think they're just counting on coaching the person through whatever privilege escalation is required when the trojan wants access to the passkey.