This is just someone siting in the middle and modifying a page not to show the passkey login option anymore and then stealing a password/session token.
As far as I can tell, this has almost nothing to do with passkeys specifically and would only apply in a situation where a website has a username and password fallback in case a passkey isn't created or isnt working.
This guy isn't kidding about the garage door springs. I had some of the old style ones in my old garage that broke and launched a piece of metal across the garage right past my head and made a giant dent in a 2x4. Those things are vicious.