Attestation is more like: The passkey is from this model of security key/phone. That can then be used to have a list of allowed devices if you really need hard

Attestation is more like: The passkey is from this model of security key/phone. That can then be used to have a list of allowed devices if you really need hardware backed security for example (eg you provide all your users in your org with specific security keys and don't want them registering anything else). It's not recommended to use the attestation part unless you really need it though as it restricts user choice.