You can't MITM a passkey, you can MITM a TOTP challenge.
That is, passkeys cannot be phished. The only way to get into my passkey protected account is to physically gain access to my passkey device, which requires both physical access to the device, and a second factor like a face/fingperprint or PIN/password.
Additionally, the TOTP secret can be copied, while today passkeys don't allow that either.
