H-infinity control uses just as any other controller the outputs to compute a new input. Internally, it does store some kind of linear combination of previous outputs and inputs that assure the resulting control signal stabilizes the system and achieves the control goal.
This can be compared to how a LQR + Observer works, the observer estimates something based on previous inputs and outputs and the LQR uses that something (in this case the state estimation) to compute the new input.
However, if this previous data would not be collected (which makes the controller a true output feedback controller), it is practically impossible to guarantee that the controller will achieve the control goal (or even stability). This assuming $C$ is not full rank.
The performance variables do indeed use the internal states to synthesize the controller. However, these states are computed from a model (as this all is done before actually plugging in the controller into the system). Since it is safe to assume this model exists, that should not be problem. However, we know that this model never is a perfect description of the system. Therefore, H-infinity allows to specify uncertainty bounds that ensure the actual system is within the described bounds. The synthesized controller guarantees stability and performance for any system represented with these bounds (assuming the performance and stability criteria are met).