[mrmanner]

Also autofill is just broken by some sites and app login screens, so users are used to looking at and typing their passwords every now and then.

[hedora]

And, of course, the malicious site can arrange for autofill to be broken.