That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"

> It doesn't limit login to one specific device, therefore it does nothing.

It's not nothing. It provides an attestation that you the user are in physical possession of the device, and have passed the challenge to release the key form the TPM (biometrics, pin, something like a yubikey).

Giving your private key to a cloud password vault makes it phishable again (via an attacker getting acsess to your vault, just like with passwords). The private keys are supposed to be non-exportable, and the cloud password managers defeat that as well.