[inigyou]

how do I back it up and transfer it to a new device? This is relevant because an attacker can also do that.

[coffe2mug]

Buy a new iPhone. Sign into it. Everything is now available.

That is the reason: for the average Joe not having exportable passkeys is good.

Average Joe doesn't have to do backup. It is all automatic.

[inigyou]

So I just have to get the victim to sign into my iPhone?

[coffe2mug]

Yes. If you are such a person then do it.