The phishing protections of passkeys also works against "malicious QR codes". Which is a great example of why passkeys are kind of good, you stop needing to worry about a lot of attacks.