I'm not giving up recovery codes, nor my ability to default to locking out people who physically have my device. I usually don't allow auto-login or biometrics login either.

If a website/app goes passkey only (or, even worse, if it starts relying only on one-time email codes), I won't use it.

I know plenty of others who feel the same, though I don't know if we're numerous enough to put a dent in a company's bottom line or not. I imagine it depends on the company and its target audience.

At the minimum, stop using goddamn email addresses for the login.