I think it's both. 1Password shouldn't have filled in that amount and Substack should have had a clear confirmation - "Are you sure you want to pay *2,023 doll

I think it's both. 1Password shouldn't have filled in that amount and Substack should have had a clear confirmation - "Are you sure you want to pay *2,023 dollars* a year?"