Passkeys and Modern Authentication

What do security professionals think about passkeys? In particular, those who were not involved in designing them. Lots of the arguments in this article feel very much like the sort of thing one would expect from someone into open source (not saying they are wrong, and I think they are well explained here) but I feel they will inevitably be the product of different concerns than those a security practitioner might have.

Pretty much everyone likes them? Nobody likes passwords, especially passwords by users. Passkeys essentially force the users to have some sort of password manager, whether third party, or OS / browser integrated. Plus they're unphishable in normal use.

They're technically weaker than password + hardware key but stronger than anything else, including password + totp. Google Advanced Protection still wants you to have a hardware key for your account.

Google's Advanced Protection Program supports both passkeys and security keys.