What's the threat model here? That someone malicious with physical access to the computer somehow shifts focus to a program they know you have running such that

What's the threat model here? That someone malicious with physical access to the computer somehow shifts focus to a program they know you have running such that, when you type your password, you send it to the malicious person. That's a very tenuous exploit, seeing as it relies on physical access and knowledge that the victim is already running a program which would hand the password to the attacker were the password typed into it, and I'm assuming that changing focus once the lock screen is active is even possible. But once the attacker has physical access, there are more things they can do, I'm certain, making this a rather pointless exploit as well. So disclosure isn't giving anyone a new road into the system, it's just making people aware of a potential security flaw in a way Apple might actually care about.