I do wish banks used WebAuthn. But I don't expect them to start, they largely seem to rely on the ability to reverse transactions instead of avoiding illegitimate transactions in the first place.