That's not necessarily true. If it is on page Javascript tracking, the script could well snoop the password before it is even in transit. This is perhaps still

That's not necessarily true. If it is on page Javascript tracking, the script could well snoop the password before it is even in transit. This is perhaps still better than a MitM as at least the bank has had some chance to vet the vendor of the tracking script. Still, if the tracking script vendor is compromised, we're back to square one.