It’s worth noting that Yubikeys, the most prevalent WebAuthn device at the moment, do not support either biometrics or PINs for FIDO2 auth.

So while yes, ideally you’d use a hardware-secured key, which unlocked that key using a biometric or PIN, that’s not the most common workflow.

The exception is devices like the Google Pixel where it’s using a built-in hardware security device.