I'd definitely settle for an option where autofill is requested by the extension, but communicated via a bridge to a native application which can safely handle

I'd definitely settle for an option where autofill is requested by the extension, but communicated via a bridge to a native application which can safely handle reprompts and cut off communication after a timeout.