AIUI: A password can be entered into a phishing site, a passkey can't.