It all depends on how it is implemented. A naive implementation might have the user's finger template stored server-side, and send the user's fingerprint to the server every time for authentication.
Better implementations will use standards like FIDO, which rely on public key cryptography. When a user registers with a service, the FIDO client generates a public-private key pair, sends the public key to the service and securely stores the private key on the device. Subsequently, whenever the user attempts to authenticate themselves to the service, the service will send the user a random challenge. The user's FIDO client will sign the challenge with the private key and send it back to the server. The server will verify the signature with the public key, and if it is valid, the user will be authenticated.
Notice that this process does not prove validity of the fingerprint, it only proves that the client is in possession of the original private key. Validating the fingerprint is up to the client, which is typically done by storing the private key and fingerprint template in a separate tamper-resistant device or secure enclave. Validation of the fingerprint and signing of authentication challenges is also done in the secure enclave, so that external malicious processes cannot interfere. It is the user's job to ensure that they only use trustworthy clients. This is not unlike traditional password based systems where using a malicious client also results in the password being compromised.
