You’ve always got the human element, bypassing security features; but extra little hurdles like a password manager refusing to autofill an unknown url is at least one more opportunity for the user to recognize that something’s wrong and back away.

If you’re already used to manually typing in the auth details, you may not even notice you’re not on the site you were expecting.