You can still get phished, and have your password be stolen. It just doesn't allow you to login in to the FIDO protected resource. Other endpoints might still work if they dont' require FIDO or you reuse the password.