Phising sites can bypass this by creating an input field which looks like a password input field but isn't actually one. +1 for password managers or U2F style

Phising sites can bypass this by creating an input field which looks like a password input field but isn't actually one. +1 for password managers or U2F style authentication systems.