Nice read Andy agarwal, what's interesting about passwordless is that it mostly requires access to another device/tool. So if a threat actor compromises your email, they can compromise more accounts using this if the passwordless method is OTP, or magic link to email.
In an organisation I feel passwords are key, as they're the source to accessing the main domain for any user and not all users have company phones for OTP, or access to work email outwith their work laptop for a magix link to be sent. That being said, should the password become compromised and SSO is in play, the threat actor has access to most (if not all) systems for that user.
It's definitely an interesting topic!
Take Care