I assume a phishing site wouldn't even attempt to use the passkey because it can't. So wouldn't it just ask for a password, and at that point, if you're gonna fall for it, you'd go and grab the actual text password anyway?

My password manager matches off of domains too, so it wouldn't suggest to autofill on a phishing site.

Right. The “correct” way for a service to handle this is to disable password logins for any account that has enrolled a passkey. A few services do this, but boy howdy is it ever unfriendly to users (or at best, difficult for them to get their heads around).

Right. It didn’t suggest it but the phishing message was convincing enough that the tech-savvy person fished the password out manually and input it anyway. A mistake for sure, and one the password manager was trying to help with, for sure, but this mistake would have been impossible with a passkey.