You have a point here. Perhaps the real solution is that we should make the browser throw a fit when someone tries to input a "password" into a page/authdialog that has no security as well.
Then the altered page just specifies that it is not a password field, and emulates it with javascript or whatever. So that could only work for sites where a password manager was used, assuming the user doesn't just go ahead and type it in themselves.
