Aren’t passkeys intrinsically resistant to those attacks? With hardware security keys, the private key remains on the device, never crosses the network, and is cryptographically bound to the site being authenticated.

The point of passkeys is that you don't need to. Unlike passwords, your session cannot be hijacked because the thing that you give your fingerprint cryptographically verified the requester.