This is something that I think is a bit of a security tradeoff. Hardware-based keys are absolutely more secure than software ones, but they come with significant usability limitations. I worry that if RPs restrict themselves to only hardware-based keys, then that will kill adoption of passkeys in general and we will be stuck with passwords. Software passkeys are already a significant security upgrade to passwords, and so I would like to see them gain adoption.

In my ideal scenario, users would be able to use software passkeys for most websites, and then have hardware authenticators either for the vault of software passkeys or directly for a few key websites.