I think the distinction you're trying to make means zilch, 1. this is the normal login flow for these users, 2. this tech provides zero protection from phishing

I think the distinction you're trying to make means zilch, 1. this is the normal login flow for these users, 2. this tech provides zero protection from phishing attacks, 3. an extension does provide protection from phishing attacks by automatically comparing the saved domain vs the page's domain byte-for-byte on every visit and not suggesting a login if the actual domain doesn't match, 4. humans have empirically proven that they cannot do 3 reliably. There is a first hand experience of this fact in this very thread: "The only time I nearly lost an account to phishing it was because I manually copy-pasted my credentials.". "choosing to attempt to login" is just bare-faced whitewashing in order to blame the user for falling prey to a phishing attack and deny that this is a problem that password managers should solve.