Passwordless Authentication on Github.com

The RP can also request not to perform it, but IME Chromium asks for PIN anyway. Firefox is not so insistent.

You can play with parameters here (look for advanced settings):

https://webauthn.io

https://webauthn.me/debugger

To be fair, under the blandest definitions of "something that you know", "I know to push this button at the right time" is something that you know (have learned/trained, even). Just because it might be obvious or easily guessed doesn't mean it isn't "something that you know". Anybody can do it, but you know to do it. Most passwords are easily guessed, many PINs are even more easily guessed and have a tiny search space (10^4 = 10,000 combinations), most signatures are easily forged, most "security question" answers are trivially googleable if people answer them honestly and don't treat them as "phone passwords".

(Similar on the "something I am" front: fingerprints are not as unique as people think, confusingly shift over time, and easily spoofed; same, sometimes worse, with "face prints". There are a lot of interesting criticisms out there of current biometric factors.)

The goal of multi-factor authentication in general is that more factors are better, and that the "strength" of each individual factor can be relatively weaker because the strength of the combined multi-factor is often (not always) stronger than the sum of its parts. You can use weaker PINs (or single button presses) than previous passwords if you trust your other factors or the interaction between factors to more than make up for it.

As usual, it is mostly up to your personal threat model if you think you need a stronger factor in place than "I know to push this button". There are Yubikey models where you can require a PIN input every time. There are other similar security keys with biometric unlocks (fingerprint readers). Similarly, too, it is sometimes just fine for someone to say, "based on what I believe my threat model to be and all my other active factors I'm fine with calling 'I know to push this button' as my most common 'something I know'."

Passkeys only survive so long as the Big Three (Apple, Google, Microsoft) push them together for mainstream users and it is a lot to suggest that those three companies can get along long enough and agree generally enough to conspire against their user's interests. If they show signs of such a conspiracy, there are anti-trust laws to deal with that. (Plus, as I said, open source and third party alternatives already.)

But if we want to talk specifics rather than hypotheticals: there actually is a FIDO standard somewhat close to what you are afraid will happen called "Device Attestation". This allows TPMs to attest (sign) that a given key came from a specific type of Device, or even in theory a specific Device. Enterprises want this because it is an asset management and additional layer of security tool to make sure only approved devices have access to corporate stuff. Microsoft and Google have implemented it to various degrees. Apple on the other hand has made it publicly clear that they don't like the privacy and user security implications of Device Attestations and just plain aren't supporting it in their Passkey implementation. I can't prove that there aren't conspiratorial things happening behind the scenes between the Big Three, but at least in these specifics you have public evidence (in both words and actions to date) from one of the Big Three that they care about the privacy of their users much more than they care about what enterprise customers demand and are going to publicly disagree with the other two companies in the Big Three about it.

Again, I doubt I can prove to you that the conspiracy doesn't exist, but it is so entirely unlikely given what we've seen so far.