WebAuthn does not pass any biometrics to relying parties. Rather CTAP, which stands for Client to Authenticator Protocol, is responsible for brokering credentials* between your authenticator (TouchID, Yubikey, your phone in the near future) and the client (in the case of WebAuthn and TFA this would be the browser).

In most of cases, typically not even the operating system sees your biometrics; only the firmware in your authenticator does.

* These are 256 bit keys for ECDSA/EdDSA or (rarely) >2048 bit keys for RSASSA. Not biometrics.

You can still use a Yubikey without giving up any biometric data. And with the way the implementation works on Apple devices at least, your biometrics are only stored in the secure element on the device, never transmitted.

>your biometrics are only stored in the secure element on the device, never transmitted.

Your biometrics are stored on the device Apple controls, not mine, because they are never getting my biometrics. Corporations and governments are free to implement whatever draconian invasions of privacy that they want in the name of "security" and "safety", but that doesn't mean the rest of us will go along with it. Certainly many will, and that is their choice.