Isn’t that a bug in the Microsoft software, not the pass key specification?

That's like saying that there's nothing wrong with passwords, it's a bug in the human that can't tell the difference between their bank and some random web form with their banks logo slapped on it created on wix.com

Several of the successful attacks that compromised passkeys have been because of flaws in the OS, or the browser, or the password manager, but none of those things are going away any time soon. Passkeys depend on those things, which means they aren't are solution to the problem of phishing. They just make phishing harder.

Passkeys also make things harder for the legitimate user though, and there's a very real question of whether the protection they offer is worth the trouble.