I think you're talking about different things. On Windows and most Linux variations, the program could install a keylogger and monitor what you type into a web browser. The browser may be sandboxed, but the malicious program you're logging into is not.

macOS might be a little more secure post-Catalina; the user would have to grant additional permissions to the malicious app. Of course, a lot of apps legitimately need those permissions, so it wouldn't be so odd to request them.