I’m ok with not considering it “public good” when something is under a license and subject to the Copyright of a particular private person/entity. But if you do need to ask consent to a private party for the use of something then I don’t think you can call it a public good.
You share public keys when registering the passkey on a third party service, but for the portability of the keys to other password managers (what the article is about) the private ones do need to be transferred (that’s the whole point of making them portable).
I think the phishing concerns are about attackers using this new portability feature to get a user (via phishing / social engineering) to port/move their passkeys to the attacker’s store. The point is that portability shouldn’t be so user-friendly / transparent that it becomes exploitable.
That said, I don’t know if this new protocol makes things THAT easy to port (probably not?).