Passkeys (depending on implementation) are more resistant to info stealer viruses.
The private key portion can be in your OS’s credential store and can be used to sign the challenge without being revealed to the calling application.
Of course this doesn’t work if you got rooted, but a lot of viruses of this kind try to steal what they can get as a regular user, and you can get a lot, ie AWS credentials, saved browser passwords etc.
In my view it’s cheap defense in depth.
Remind me, who owns WhatsApp?