It sounds like they're saying that if you can manage your passwords then do so yourself and avoid passkeys, but if you can't/don't want to then use passkeys.

And they are pointing out that the company is far more likely to lose your password than you are.

Convenience vs security, but the weakest link is probably not the user.

I think you're mixing up compromise of an account with compromise of the data associated with that account.

If a particular piece of data is accessible to people of a dozen accounts, compromise of any of those accounts potentially compromises the data. That's a legitimate concern for people who want certain data secured, whether other accounts with access are also secure. In some cases, it may be best to have an authentication policy that provides a baseline level of protection even for the most clueless users, rather than a system where you're able to secure your own account.

I’m saying that bad user passwords allow data to be hacked. When it’s the credentials of someone with access, like an employee of companies with your data, then that data is more easily compromised if they have crappy passwords. It’s harder to compromise with passkeys. It is not just your password hygiene that protects your data.

Here is a recent example in Australia. https://www.abc.net.au/news/2026-10-06/asos-app-users-sent-hacked-message/107236520