When people talk about biometric authentication for the web, usually they are referring to the Web Authentication standard; a new, standardized method of user authentication which has been implemented in many popular web browsers.
The web authentication standard does allow users to sign into websites using biometric authentication (e.g. fingerprints), but it doesn't work the way you've assumed in your question. As you've correctly surmised, sending a copy of the user's fingerprint to websites for them to store would be terrible both from a security and a privacy perspective.
Thankfully, the web authentication standard does not work that way. Instead, it works by generating a site-specific private key and storing that key somewhere on the user's device. Then, when the user wants to sign into a site, their browser uses this stored key to prove the user's identity to the site using public key authentication, signing them in.
So where do biometrics come into this? Using the web authentication standard, it is possible for websites to request that the user's browser verify their identity locally before allowing them to sign-in using the stored public key. This local verification can be done using biometrics, among other methods. The W3C standards document explains:
6.2.3. Authentication Factor Capability
There are three broad classes of authentication factors that can be used to prove an identity during an authentication ceremony: something you have, something you know and something you are. Examples include a physical key, a password, and a fingerprint, respectively.
All WebAuthn Authenticators belong to the something you have class, but an authenticator that supports user verification can also act as one or two additional kinds of authentication factor. For example, if the authenticator can verify a PIN, the PIN is something you know, and a biometric authenticator can verify something you are. Therefore, an authenticator that supports user verification is multi-factor capable. Conversely, an authenticator that is not multi-factor capable is single-factor capable. Note that a single multi-factor capable authenticator could support several modes of user verification, meaning it could act as all three kinds of authentication factor.
Although user verification is performed locally on the authenticator and not by the Relying Party, the authenticator indicates if user verification was performed by setting the UV flag in the signed response returned to the Relying Party. The Relying Party can therefore use the UV flag to verify that additional authentication factors were used in a registration or authentication ceremony. The authenticity of the UV flag can in turn be assessed by inspecting the authenticator's attestation statement.
Since this verification happens locally on the user's device, there is little chance of the user's fingerprint information being leaked to attackers. Furthermore, since the fingerprint is merely an additional layer of protection for the WebAuthn key, an attacker who did somehow get a copy of the user's fingerprint wouldn't be able to use it to sign into their accounts without also having stolen the device the user's private key is stored on.
So to summarize: while biometrics alone would not be a good way to authenticate users on the web, the way it is implemented in practice is actually quite secure. Quite a bit moreso than passwords in fact.