Using strong password as you suggested is a solved problem for your use case, but that is not universal. Passkeys provide universal security for all.

Also PIN or biometrics verification to access passkey from device bound TPM or security enclave solved the problem you implied might happen, such as losing your device. How do you protect your password manager, if any?

> even those can have vulnerabilities.

We shouldn’t just give up because everything is inherently insecure.