It's a fair point, and the complexity nearby that the article is highlighting emerges from exactly that.
But my assertion is basically what the article itself say a few paragraphs in:
"The cryptography inside FIDO2 can remain completely intact while the account protected by the passkey is still compromised."
But that's not the way the title reads. For busy defenders and the layperson, the title reads as the equivalent of "fido2 itself compromised". Which drives clicks.