Passkeys are really long password locked to a domain, i.e. no different* than your setup.

Passwords are just a worse, hacky version of passkeys.

*They are private/public keys, so they can’t be MITM.