That's slicing it rather finely. After transfer is complete, the host device opens the transferred data. When combined with CVE-2016-4657 on an unpatched device, they allow an attacker to gain control of the victim's device after they accept the airdrop. We can call that a Webkit vulnerability instead of Airdrop (because it is), but end of the day, Airdrop is another route for attackers to gain access to your system. You can choose to enable it if you deem it useful enough, but it would be naive to blindly believe "it's fine".

Now, the victim has to accept the Airdrop payload, and Airdrop has limited range, so it's not as scary as the Pegasus iMessage exploit which was totally remote, but I wouldn't bet my life on the Airdrop code having zero bugs.