It’s not just man in the middle.

If the credentials get stolen from a website database, they’re useless for every other website on earth. No matter how poorly they’re stored, it’s just a public key and is not useful. Hell, they can get code executing on the webserver that collects full login information, and it’s not useful.

Passwords always require full transmission. Hashing for storage requires a proper implementation, which we’ve seen does not happen. 100% of the time. There’s a reason hackers are still stealing passwords from websites after three decades.

Passkeys solve that. Nothing else available to the average user does.