For the user this is extremely simple. For the programmers it's a bunch of new stuff to learn (or a new library to pull in) when implementing it, including things like you're going to want a whole new RDBMS table not just a wider "password" in the database - but for the user it's very simple and impossible to get wrong.
I implemented it by hand for my vanity site, it was not a tremendous amount of work. GitHub - since they are the topic after all - offers it today. But beyond big hitters (e.g. Gmail, Facebook) I am disappointed by how few have bothered.
It's a night and day difference in terms of security and in terms of ease of use but it seems most places aren't interested in doing more than the very bare minimum.
I'm certain such a person uses TCP/IP every day and doesn't need it explained. Yet twenty years ago, some knowledge of IP addresses and subnet masks etc was necessary to get connected.
I think what prevents wider adoption of WebAuthn is the fear that users are going to lose their phone and not have a backup authenticator. But, people probably lose their phone less often than they forget passwords, so I doubt it changes the support burden much.
Though from a developer POV I can certainly see why passwords are so attractive: take a word, hash it, compare hash on subsequent logins.
The alternatives are tricky, but not I suspect impossible, to do in a decentralised manner. I've often pondered that something like PGP servers with revocation certificates, but adapted to logins would be near the realm of a solution.