The point is that not all protocols are created equal. So "we shouldn’t have created HTTP" depends on what HTTP is specifying.

If a protocol makes it easier for big players to abuse the system, then it's a worse protocol in that respect.

The point being made against passkeys is that, in some respects, it's worse because of the inclusion of attestation as part of the standard.