How well are #Passkeys protected on Android / Google Password Manager?

According to this article, on Mac/iOS it relies on the Keychain and Hello on Windows, while not perfect it feels like it would offer some resistance against stealers where they would at least need to prompt the user vs silently being able to extract them?

But how about #Android and #malware ? I would assume it's equally well protected but I can't find any information.