I'd argue that WebAuthn may be classified as transferable? Under the assumption one's using a FIDO security key of course - rather than the platform's built-in authenticator.

I too believe passwords will have their role in the future - although I'd love to see their roles swapped: WebAuthn as first authentication factor - passwords as the optional MFA.