password managers do the backup for you based on how you set them up (eg. to your google drive, or to a simple SFTP/FTPS/S3 URI)

those that don't have this built-in (eg. KeePassXC) recommend using Dropbox or some external sync mechanism

but the keys are stored in a file, which you can back up.

> all the security vanishes if you put usable recovery mechanisms for the passkey or the second factor

no, not at all. it still gives you better UX, because when you use the passkey you know it's the site you want to log in to. (because there's mutual authentication.)