Ok, I don't see, why they should accept paste at all!
I do not have an Android phone or a password manager, but I still do not get the point here. The device is locked, so how do I access the password manager?
When you said "they" I thought you were talking about password fields as a whole, not this single field.
And even then, any OS could be run in a VM, so why not accept paste, it won't hurt anyone.