The clipboard is extra vulnerable. It requires no privileges at all to read. Up until very recently, JavaScript in your browser could pull content directly out of your clipboard.

Even beyond that, copy and pasting is training users to copy and paste. This is an even bigger threat imho. There is no layer of extra validation.