I agree that sensitive data should be handled much better, but - at least in a webapp - they don't capture screenshots, they just only capture mouse movements, clicks and scrolling and then rerender that on the html.

Many of these companies (e.g. FullStory, Hotjar) obfuscate all input fields for exactly this reason.

I’m sorry but they don’t, at least in a sensible defaults, easy/reliable way. Unless they’ve changed recently. We did extensive testing and found it was up to the end user implementing the integrations, and their regard for this topic/privacy.