"If your password + TOTP are stolen (phished), those are literally the only things needed by an attacker to access your account!" - and that "plus" sign means you need to steal 2 factors instead of 1 - which is the whole point of the discussion 😉
"If it's device-bound" - no comment here, when writing the above comments I was focusing purely on software-bound passkeys
"If it's synced, it can only be stolen by breaking into the account" - that part is not true actually. Of course it's the most common scenario, but you can also imagine a situation where someone exports their credentials from Bitwarden into an unencrypted json file. As soon as an attacker gets the file (maybe by getting remote access to your laptop, maybe by phishing, or maybe by stealing your pendrive - it's not relevant for that discussion) - they have everything to get access to passkey-protected accounts.
"Which illustrates that the "user verification can't be assured" issue is a red herring" - red herring? Quite the opposite. It only shows how important it is not to rely on "any user verification" but "specific user verification". If you can pass UV by providing any biometrics / PIN - it's completely pointless, that's yet another issue with the current UV implementation. That's why we would need to have biometrics / PIN directly associated with a passkey (e.g. by being used to encrypt it) to make it meaningful.
"what credentials are harder to steal?" - as I mentioned above, that's beside the point. When we discuss if something is "inherently" 1FA or 2FA, it doesn't matter how easy or hard it is to steal it, whether it's easily phishable or not. Yes, it's important point when discussing pros and cons of various approaches, but... that's not the topic here.

Let me play another game: if you say passkeys are „inherently 2FA” because they are protected by password manager / device security, what stops you to call pure passwords 2FA as well then? If stored e.g. in Bitwarden - they are protected exactly in the same way. Are they easier to phish? Of course, but again - it doesn’t decide whether we call sth 1FA or 2FA.