> Only one specific device can ever login
That's entirely service dependent, and the standard doesn't mandate "Service must not allow multiple passkeys"
Unfortunately, given the laziness, incompetence, and cost-consciousness of organizations like traditional financial institutions, telcos, governments, etc., many of them have & will end up with that implementation.