I read the federal government’s Zero-Trust Memo so you don’t have to

How do you do MFA without a password? I thought it was "what you know" "what you have" "what you are" etc?

You only need two of the three factors to make it multifactor. A computer with a fingerprint scanner could be enough if it’s implemented properly. It’s something you have (a specific computer with a specific fingerprint scanner) with something you are (the fingerprint). In practice, you also need to know an identifier like an email or username, but those are often considered public.