One of the main things that surprises me about the new WebAuthn standard is the fact that these biometrics or U2F keys replace passwords instead of complementing them. Why is this done, and is it secure?
WebAuthn does not replace passwords, it's up to you to decide if you want to use only WebAuthn or password + WebAuthn.
WebAuthn just standardizes the protocols and APIs for using various hardware based (mostly) authenticators.
Its just a side effect that using WebAuthn authenticator (token) may remove the need for passwords. That's why it's sometimes advertised as "password killer".
Also, WebAuthn is not limited to one factor, this depends on the authenticator used. Almost always authenticator provides "possession" factor, but it's not limited to that and can also be combined with "knowledge" and/or "inherence".
Whether WebAuthN can work as the only factor for authentication or only as a second factor depends, among other things, on the authenticator's capabilities.
The specification's section on taxonomies of authenticators explains this very well: Only authenticators listed as
Multi-factor in the
Authentication Factor Capability can replace an existing combination of a password and second factor (for example, Password and Yubikey).
Of course, it is ultimately up to the Relying Party, i.e. the site or service allowing WebAuthN-based authentication, to decide whether it is willing to accept a single factor only for authentication (e.g. password only; Yubikey only), a multi-factor capable authenticator (e.g. a CTAP2-capable Yubikey together with PIN entry) or any combination thereof (e.g. password and Yubikey without PIN entry, password and platform authenticator with biometric authentication).
For example, you could imagine a site allowing initial logins using a Yubikey only, but subsequently requiring Yubikey + PIN entry for sensitive operations (e.g. money transfers, registering additional authenticators etc.)