Code coverage tools are generally specifically about test coverage, not which code actually gets executed or is unreachable.
Code coverage tools are for whatever you want to use them for. Lots of people use them to measure test coverage, but you can also use them to measure code usage in production. There are a variety of different ways to instrument code of various different levels of invasiveness and performance impact. Even the Linux kernel has built in instrumentation for measuring code coverage (kcov).
Yes, and it was a huge mistake, as a passkey stored on insecure media is effectively just a password with extra steps as far as the cryptographic guarantees are concerned.
The argument that restricting them to secure devices such as TPMs would hurt adoption and prevent passkeys being migrated to other devices is a completely bogus one.
Firstly, all consumer devices now ship with TPMs or a secure enclave equivalent, so the argument that users simply don't have the hardware is no longer true. Even if it was true before, there's no value in a software passkey when it can be just as easily stolen as a saved password or browser cookie.
Secondly, the problem of migration has already (now) been solved by the FIDO spec writers and passkey migration has a well-defined protocol to support it. Moving to software implementations was never required to solve this problem.
So why did they allow this to happen? In my view it started because the usual Big Tech suspects saw passkeys as an opportunity to enhance their ecosystem lock-in by adding another repository of important data that they manage for the user in their OS product, instead of it being a separate ecosystem managed by a piece of hardware that the user purchases such as a Yubikey.
This is why the question of migration was expedited in the first place, not because migrating keys from secure devices is hard, but rather because people could see that vendor lock-in was going to occur with the software passkey implementations.
I feel like the effect of the social media zeitgeist has turned a lot of people, especially those born in this century, into permanent performers. That's not to say that their actions are purely performative, rather that to them if it doesn't happen in view of the entire internet then it may as well have not happened at all.
The cloud is just somebody else's computer.