> there always needs to be less secure means of authentication because hardware-based authentication must be replaced, sooner or later.
Thats not the case; there is a much better approach which doesnt require a security compromise: spare passkeys pre-configured as fallbacks apriori.
Google already implements this by requiring 2 passkeys when you enable their highest security settings. One is the active/primary, and the other serves as a backup in case your primary passkey gets lost or destroyed. So you can leave one at home in a safe place and keep your primary with you. You can be confident the hardware passkeys have zero ability to export secrets whatsoever, so cannot be cloned nor leaked. And you are not limited to one spare, you can have many spare passkeys if you suspect you will need them.
Allowing secret exports utterly undermines the very foundational security of passkeys in the first place. If a secret can be exported, it can be intercepted. People are going to get phished of their passkeys via the backup mechanism - because a big part of the design of passkeys was that average users are not smart about handling secret keys so they should neither need nor have the ability to leak them.
And the vast majority of passkey hardware devices are not set up with the needed mechanisms to even enable advanced users to do such an export safely. (basically a on-device dedicated screen and keyboard would be needed to safely export with zero risk of intercept)
The real motive for backups is of course to allow centralized service providers to have the option to spy on the secrets and/or monitor user activity across sites for ad farming.