Not in all situations. And in a way a user will not be aware of. The service or website can define what type of passkey is allowed (based in attestation). You may not be able to acutally use your “movable” keys because someone else decided so. You will not notice this until you actually face such a service. And when that happens, you can be sure that the average user will not understand what ia going on. Not all passkeys are equal, but that fact is hidden from the user.
There are ways to save messages before they are deleted even if the stock app is used. Do not ever rely on this feature to work in a “safe” way.
That is a problem the users who prefer 3rd party clients have to deal with. Obviously if you care enough to not use the official build, you of cause have to take care of using a trustworthy source. That is not “your problem” though.
That sounds a lot like “I don’t use it, so none else needs it either” argument. In my opinion, none of your arguments above are a good reason to combat 3rd party clients.