That’s more a failure of the form creator as password fields were never persisted to the history. If you don’t tell the browser that the input is for sensitive data it won’t protect it of course.