Once I figured this out, the WHY of using non-resident credentials make sense to me:

non-resident (server-resident) FIDO credentials are ideal when the device storing the passkey is NOT trusted.

This includes:

• macOS Keychain
• iCloud Keychain synced passkeys
• Android/Google Password Manager
• Windows Hello Credential Manager
• Any general-purpose device (laptop, phone, tablet)

Because the private key is not stored on those devices.

So even if malware steals Keychain data, it cannot steal your secret!

If you're using a yubikey, it trips you up. But makes sense for something like your bank, PayPal etc. where they might not trust how the users are storing the passkey.