Low risk of lockout, but about as high-severity as one can imagine. Yes in theory sites should offer a password fallback, but how many actually do? And of those that attempt it, how many get it right?

Not even Google reliably lets you fall back to a password, according to the comments in this article. Losing access to your google is anywhere from major inconvenience to professional disaster.

Expecting every user (site using passkeys) to implement complicated flows is a time-tested recipe for disaster, and it's a bummer to see that unfolding yet again with passkeys.