It's mainly controversial because the actual use contradicts its purpose. Passkeys are phishing-resistent, which is still the main risk for password in real world scenarios, and are a good idea.

But the websites supporting it put out big warnings when you don't have another method to login configured. And they don't actually advise you how to backup your passkey and keep it safe, but instead want you to set up an alternative way to login or recover your account. Which totally defeats the purpose in the first place.

Quite the contrary: "there is a problem with your passkey/account, please use the recovery method you set up" even makes for more convincing phishing. So why are they pushing for passkeys when it isn't for security reasons?