An attacker could probably emulate a form in JavaScript without using any actual input fields. Displaying the indicator on user input seems much more difficult

An attacker could probably emulate a form in JavaScript without using any actual input fields. Displaying the indicator on user input seems much more difficult to bypass.