No. You can already do that without an attack if you use resident keys. (aka passkeys *without* a username) This only means that someone with your PIN and extended access can clone it.