It seems like the headline buries the lede here.
The problem is passwords being exposed in plain text. I already assume that my browser extensions can see everything I do, which is why I only use a couple of open source extensions with solid reputations.