Passwordless was a waypoint
Removing the password removed a class of attacks. It did not remove the attacker. Phishing adapted, and the industry learned that "no password" is not the same as "no phishing."
What phishing-resistant actually means
Phishing-resistant is not a stronger factor. It is a different relationship between the user and the action. The system does not trust the credential alone; it ties the action to a person it can prove is present and authorized.
The destination
The finish line was never passwordless. It is proof of a person. Everything else is a step on the way.