Threat model is simple: people look at your passwords and type them in somewhere else. What's technically possible for serious malware, or what someone can do

Threat model is simple: people look at your passwords and type them in somewhere else. What's technically possible for serious malware, or what someone can do with unlimited access to your computer for hours is not the point. Reality is time-constrained, and UIs that slow people down are useful in this case.