[Scion9066]

I hope that the availability of using device-based (using the built-in hardware in a device they're less likely to lose like a phone/laptop) or account based (like the passkeys synced to iCloud/Google/Microsoft) will help mitigate the issue of people losing them. Regardless of which option they use though, they should treat them like home/car keys and have backups in place.

As for the biometrics, when people talk about biometrics for authentication, they are usually talking about using the biometrics to unlock something stored securely on a device. Without the device that has the actual credential being used, the biometric that has been copied doesn't do attackers much good.