Under passkey implementations, you need to unlock the passkey device with biometrics or passwords. Something you are/know (biometrics/passwords) and something you have (passkey).

It's not impossible to screw it up. Put your passkeys in bitwarden, reuse a password and don't 2fa that.