WebAuthn distinguishes user presence (UP, a touch or click proving someone is there) from user verification (UV, proving who). Relying parties ask with userVerification: "required", "preferred" (the default) or "discouraged" and must check the UV flag (bit 2) themselves when they rely on it; a credential used with UV is a multi-factor authenticator in NIST's terms because it combines possession of the key with a PIN or biometric.
The biometric or PIN never leaves the device; the server learns only that verification happened. Pitfall: requesting preferred and then treating every assertion as two-factor, although some authenticators (older security keys without a PIN set) return UV = 0.