I’m ok with not considering it “public good” when something has a license that sets conditions and it’s under Copyright of a particular private person/entity. But if you do need to ask consent to a private party for the use of something in a derivative work then I don’t think it makes sense to call it a public good.
You share public keys when registering the passkey on a third party service, but for the portability of the keys to other password managers (what the article is about) the private ones do need to be transferred (that’s the whole point of making them portable).
I think the phishing concerns are about attackers using this new portability feature to get a user (via phishing / social engineering) to export/move their passkeys to the attacker’s store. The point is that portability shouldn’t be so user-friendly / transparent that it becomes exploitable.
That said, I don’t know if this new protocol makes things THAT easy to port (probably not?).