I think passkeys with single auth are fine because of how they end up being stored and managed.
If you use them via Windows, iOS, Android, or macOS, they are tied to the biometrics on your device. Someone has to steal your device and unlock it to get in. They have to have something you know (phone unlock password) and something you have (biometrics).
In a password manager case, trust is moved from the client device to the password manager itself. It is assumed that the password manager implements these things. For example, my 1Password needs to have both my password (something I know) and secret key or existing logged in device (effectively, something I have, as I don’t regularly type in my secret key as a password and don’t have it stored digitally except for within the password manager itself) to be logged in.
"If you use them via Windows, iOS, Android, or macOS, they are tied to the biometrics on your device."
There are no biometrics on my primary devices, which are desktop computers. No camera or fingerprint reader.
Your client device OS will not allow you to create a passkey without a local unlock PIN/password or biometric, and those local unlock methods do not traverse the Internet (they are handled with TPM/Secure Enclave).