I don't have YouTube Pro or whatever its called now and when I listen to music on my Google home it plays an ad after ever song. Since I have switched to Pihole and blocked googles DNS servers the only ads I get are to buy premium YouTube which I assume are hardcoded into something somewhere.
We better be careful, with Googles track record they will be getting rid of YouTube soon and rolling it into whatever they are calling their Skype clone nowadays.
This is just someone siting in the middle and modifying a page not to show the passkey login option anymore and then stealing a password/session token.
As far as I can tell, this has almost nothing to do with passkeys specifically and would only apply in a situation where a website has a username and password fallback in case a passkey isn't created or isnt working.