You need the password for the lost passkey flow. Well, you don't need it, but it's an extra layer.