It might help to think of them like that, but they aren't the same in some pretty important ways. The website never gets access to your private key like they do

It might help to think of them like that, but they aren't the same in some pretty important ways. The website never gets access to your private key like they do with passwords. So even if a website has it's database breached, there isn't a need to reset your passkeys since they were never compromised. I guess maybe you might have to be sure the attacker didn't replace your pub key with their own.