We use passkeys at work. And as mentioned elsewhere we can configure multiple phones to issue a passkey so losing one isn't a problem

The one thing I fail to understand, though, is how if you're trying to use your phone as a primary device, how does passkey stuff (unless it's fingerprint protected) protect against an attacker using the phone to protect itself? (The other classic is "scan this QR code" - how do I scan the phone screen with the phone camera? I guess there must be a way, but I don't have a clue ...)

Cheers,
Wol