The phone says, well, I am me, and this user is my owner because their fingerprint matches, so here you go, here is my signed message saying I promise I'm still me and my user is still whoever they are, let us is.

The technology to make that work is a bit easier for Apple because they own the entire ecosystem, on Android there's some shenanigans because you can install a different Web Browser (e.g. Firefox) and this still needs to work, yet it mustn't work if that free-to-play match four puzzle you installed claims to be a web browser that needs to log into your bank... so Google actually gives out "This is really a web browser" Android stickers for release builds of e.g. Firefox that let WebAuthn work.