Sure, but it does not protect against phishing. If they visit something that looks like their bank site, but isn't, they will type in the password from the pape

Sure, but it does not protect against phishing. If they visit something that looks like their bank site, but isn't, they will type in the password from the paper. If they were using a password manager with proper integration it would notice the domain mismatch and refuse to fill.