Yeah, it definitely is more appealing from a marketing perspective.
I do understand why some projects might wanna use the term, it’s to their advantage to be associated with “open source” even if the source code itself has a proprietary license.
The problem is that then it makes it harder / more confusing to check for actually openly licensed code, since then it’s not clear what term to use. Already “free software” can be confused with “free as in free beer”.
You share public keys when registering the passkey on a third party service, but for the portability of the keys to other password managers (what the article is about) the private ones do need to be transferred (that’s the whole point of making them portable).
I think the phishing concerns are about attackers using this new portability feature to get a user (via phishing / social engineering) to export/move their passkeys to the attacker’s store. The point is that portability shouldn’t be so user-friendly / transparent that it becomes exploitable.
That said, I don’t know if this new protocol makes things THAT easy to port (probably not?).