The clipboard is not exactly a secure channel. Browsers need to catch up to mobile and provide dedicated APIs for password managers to hook into so they don’t have to interact with the DOM.