If I had to make a guess, the website does get the last four digits of the real card. I just started the process of using Apple Pay on a website to buy something and the website does get the last four digits of the real number. This is, seemingly, confirmed in the Apple Security Guide and how it works when actually using it:
Apple Pay can be used to pay for purchases in stores, within apps, and at websites.
support.apple.com
The app requests any pieces of information it needs to process and fulfill the transaction, such as the billing and shipping address, and contact information. The app then asks iOS, iPadOS, macOS, or watchOS to present the Apple Pay sheet, which requests information for the app and other necessary information, such as the card to use.
So, the first thing presented in the Apple Pay sheet is the list of cards you have registered. Note that that list has the image of the card and shows the last four digits of the card. So merchant has that info for presentation purposes and could (seemingly) use it to use on the receipt. That info is in the card information section in Wallet for the card.
But the fake number is used for purchase: once a user approves a transaction, a purchase token is sent back to the user, payment information/token is generated in Secure Enclave and sent to AP servers and then the merchant, all using the device-specific card number.
(Last AP purchase not in person was last year for me and never paid attention, so, YMMV. Sub "app" with "website" above as the process is basically the same, just some different details to deal with web things)