[tialaramex]

> ... then phishing is less effective as it’s quite rare

In practice users who're successfully being phished curse the password manager and override it. Not always but often enough.

WebAuthn bakes the site-specificity into the protocol thus preventing you from shooting yourself in the foot, even if you're convinced that's what you need to do.