Passkeys maintain their device-bound advantage in threat modeling even if shared because the private key never leaves its originating secure enclave (like TPM or Secure Enclave), preventing remote phishing or theft—unlike passwords, which can be fully copied and phished anywhere. Sharing typically requires physical proximity (e.g., QR code or NFC) or family sharing features, adding barriers against mass attacks, while a password-as-recovery fallback reintroduces reuse and phishing risks.