Suppose one does trust their OS developers. And they want to use some passkey-protected service. Does that service also have to trust the OS developers? Corre

Suppose one does trust their OS developers. And they want to use some passkey-protected service. Does that service also have to trust the OS developers? Correct me if I'm wrong, but I'm under the impression that services can decide whose passkey implementations to trust. Seems like that should be up to the user, not the service.