Just to be sure - are you asking if the User Verification (UV) parameter allows bypassing the webauthn verification if the user has already provided a password? If so, that's not the point - your application can decide that (e.g. if a user tries to log in in rapid succession, or for the first time with that IP, etc.) then you do the 2nd factor.
If you send a webauthn challenge, you only have to wait for the response and validate it. The UV is just a flag you'll get in the response that says whether the user verification was done or not (e.g. if a PIN was entered or fingerprint scan was done). But the security device will have to respond to the challenge (or timeout), it's not optional.
With a mobile phone, the UV is the fingerprint/face scan.
I've got a bunch of cheap 10$ security keys I use for testing. Those just have a big flashing button I press, no user verification is possible. So anyone who steals those from me would get full access. Also, those keys fail to register with my application if UV is Required. I think that's the proper behavior.
If you've got a public web app, it's not on you to check whether the authenticator is compromised or not. It just has to respond properly (the challenge signature is valid). If we're talking about an enterprise or government setting, all keys provided to employees must be provided by the employer anyway. I worked for governments and we used Entrust Tokens, nothing else was allowed in prod.