I wanted to know whether a second sign-in step, or a passkey, actually stops account takeover, and if not, what gets past it.
MFA does cut takeover sharply. The most detailed published study, by Microsoft staff, estimates a 99.22% reduction, though only among accounts already flagged as suspicious; the 99.9% figure everyone quotes has no published method behind it and I'd stop using it. Ordinary MFA has been beaten in real incidents in five ways I could document: repeated approval prompts until someone accepts, staff reading codes out loud, phone numbers taken over, sessions stolen after login, and help desks persuaded to reset or move a user's MFA. Passkeys and security keys genuinely defeat fake login pages, and in one campaign staff typed their passwords into a phishing page and the attack still failed because a hardware key was required.
What passkeys don't do is protect the session after login, or the recovery path when someone loses a device. US standards say so plainly and UK guidance expects attackers to turn to recovery, but the newer controls for both are optional and the outcome data is scarce. Proportion matters here too: bypassing MFA appears to be a small share of attacks, with over 97% of identity attacks in one vendor's data being password guessing, and several of the major breaches involved no MFA at all. Nothing suggests MFA created these bypass techniques, only that attackers found ways around it.
So it isn't solved, but the gap is narrower than the bypass stories imply. I'd finish MFA coverage before starting a passkey programme, check each of those five routes against your own deployment, and remove the weaker factors still sitting alongside passkeys. Whether session binding measurably works, and which help-desk checks actually stop a malicious reset, I can't settle.