The “narrow threat model” actually applies to a very common social scenario where people share computers. For instance a family member might want to play Steam

The “narrow threat model” actually applies to a very common social scenario where people share computers. For instance a family member might want to play Steam games, or print, or simply browse the web. Most people are not going to create a guest account for that. There passwords are then at risk if not adequately protected. Even in work contexts, “hey can I use your computer to print something? Mine is frozen” is very common. There was a similar discussion on the chromium tracker when they started storing passwords. I believe Chrome now use OS services (DPAPI on Windows and Keychain on MacOS) to protect passwords.