All auto-password filling on iOS requires 2FA so Apple doesn’t have to fear or how it’s to explain that Apple hasn’t mitigated this attack vector yet? For webs

All auto-password filling on iOS requires 2FA so Apple doesn’t have to fear or how it’s to explain that Apple hasn’t mitigated this attack vector yet? For websites, leaving the site auto signed-in seems the more practical way to exploit the vulnerability, so don’t leave sensitive site auto signed-in and use a native app for them instead is the natural way of mitigation?