There are two important attributes of a password: they're (often) human-memorable and prone to reuse / inexact reuse on other sites, and they're a long-term authentication token. JWT refresh tokens have the second attribute. But so are many other things, like regular old cookies that don't expire for weeks or months, which browsers store on a regular basis. If you're logged into HN you have one of these.

While the HN cookie is HttpOnly, this isn't really putting it in more-secure storage: an XSS attack against HN can just issue whatever API requests to HN it wants, even though it can't easily walk off with a copy of the cookie.