If there is malware on the pc then the browser itself must be assumed compromised. It's futile to half plug one small hole while a million others exist. And by

If there is malware on the pc then the browser itself must be assumed compromised. It's futile to half plug one small hole while a million others exist. And by attempting to plug that hole you've added an inconvenience that may encourage users to use a less secure password.