As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, an

As a thought experiment, playing devil's advocate in a way, suppose the boss tries to be reasonable and ends up telling the developer "you make a good point, and I would support it, but my hands are tied because x." Presumably there is some value of x here that, while terrible for UX/a11y, actually exists in some fashion when it comes to using the clipboard for passwords. Maybe the fact that all apps can arbitrarily read from the clipboard, and people tend to be too lazy to copy a non-secret to the clipboard between pasting a secret and opening a sketchy app? Recent versions of Android toss up a toast notification saying something like "<app> has pasted from the clipboard" when an app does so, and I've seen it for no apparent reason in some apps -- usually apps associated with IoT junk, but sometimes even apps that ought to be reputable. I'm not normally a fan of ecosystem lock-in, but using Google products as my password manager, browser, and mobile OS means I very rarely have to use my clipboard for passwords, which is a good feeling. Unlike a third-party password manager with a great browser extension could offer, this ensures seamless autofill with most mobile apps nowadays, too.