I'm not sure what would I use WebAuthn for, if ever, maybe I could disable it through "Feature Flags" menu?; regardless, I never treat Apple's services as "premium", since the email fingerprinting thing. I pay mainly for Hide My Email, just to organise things per domain, and it's cheap.
Correct me if I'm wrong but doesn't Apple disallow any actual 3rd party browser engines? Like, any browser on iOS that isn't the standard safari is just a skin on top of webkit/safari. It doesn't exactly inspire confidence that some third party browser will be able to implement things any better (as compared to like, running Firefox on Android, which actually implements the firefox browser engine).
I couldn't figure out how to get any changes to reflect but maybe it's a good pointer towards a solution?
EDIT: Reading into this, looks like they're very intentional about not allowing arbitrary enable/disable calls to it, likely to prevent a hostile entity from switching it off on unsuspecting users. The systems setting calls an XPC into a daemon that makes a web request, then validates the response from the API to update the PLIST structure.
I did not verify whether it works reliably.
If it does, one could probably package it as a .app and grant only that the Accessibility permission.
On Mac, Firefox and Chrome, which don't use WebKit, handle WebAuthn themselves.