Counterexample: the swisspass. It's a private service from the swisspost, and they whitelist webauthn providers. For example, you can't use bitwarden https://community.bitwarden.com/t/follow-up-on-bitwarden-pas... So the danger is there today, not in the future, since I'm already cut out today from the service, unless I use some hack