It's up to a website whether or not it requires your approval to use a passkey in any given situation. Some will require it only for higher-risk actions. This is because you've already had to use your biometric information, PIN or password to unlock and use your device — so because it's unlikely someone would grab it from your hands, or sneak up to your desk when your back is turned, it's a reasonable assumption that it's still you using it.
