Except this basically leaves the passwords in the hands of the companies. It's like Yahoo saying "you don't need a password anymore, we'll just create one on the spot for you".

That's not what I imagined for a passwordless world. I don't want the companies to basically keep the passwords for me. I'd much rather put my trust in fingerprint scanners or other biometrics.

You can't change biometrics, ever. You can spoof them, same as a text password can be cracked. They're HORRIBLE factors.

They won't even need to bother. State-level actors usually have access to the phone company networks.