That last part sounds overdone:

And it's unclear whether the type of sophisticated malware that routinely infects consumer and enterprise Windows users will be able to decrypt encrypted database contents.

Thanks to W11 requirements for a tpm chip, I don’t think it’s a stretch to assume it uses the same method as Passkeys use.